netdev - Re: Patch fixing STP if bridge in non-default namespace.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230711032217.46485-1-kuniyu@amazon.com>
Date: Mon, 10 Jul 2023 20:22:17 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <hcoin@...etfountain.com>
CC: <netdev@...r.kernel.org>, <kuniyu@...zon.com>
Subject: Re: Patch fixing STP if bridge in non-default namespace.

From: Harry Coin <hcoin@...etfountain.com>
Date: Mon, 10 Jul 2023 08:35:08 -0500
> Notice without access to link-level multicast address 01:80:C2:00:00:00, 
> the STP loop-avoidance feature of bridges fails silently, leading to 
> packet storms if loops exist in the related L2.  The Linux kernel's 
> latest code silently drops BPDU STP packets if the bridge is in a 
> non-default namespace.
> 
> The current llc_rcv.c around line 166 in net/llc/llc_input.c  has
> 
>         if (!net_eq(dev_net(dev), &init_net))
>                 goto drop;
> 
> Which, when commented out, fixes this bug.  A search on &init_net may 
> reveal many similar artifacts left over from the early days of namespace 
> implementation.

I think just removing the part is not sufficient and will introduce a bug
in another place.

As you found, llc has the same test in another place.  For example, when
you create an AF_LLC socket, it has to be in the root netns.  But if you
remove the test in llc_rcv() only, it seems llc_recv() would put a skb for
a child netns into sk's recv queue that is in the default netns.

  - llc_rcv
    - if (net_eq(dev_net(dev), &init_net))
      - goto drop
    - sap_handler / llc_sap_handler
      - sk = llc_lookup_dgram
      - llc_sap_rcv
        - llc_sap_state_process
	  - sock_queue_rcv_skb

So, we need to namespacify the whole llc infra.