netdev - Re: kernel BUG on network namespace deletion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEmTpZHcXrPTC15KS9SvC6auK1G2nugny_wQA411+9CXrW0dgQ@mail.gmail.com>
Date: Mon, 15 Jan 2024 15:00:36 +0500
From: Марк Коренберг <socketpair@...il.com>
To: netdev@...r.kernel.org
Cc: stable@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>
Subject: Re: kernel BUG on network namespace deletion

Hi, netdev. I have found a bug in the Linux Kernel. Please take a look.

пн, 15 янв. 2024 г. в 13:25, Greg KH <gregkh@...uxfoundation.org>:
>
> On Mon, Jan 15, 2024 at 12:19:06PM +0500, Марк Коренберг wrote:
> > Kernel 6.6.9-200.fc39.x86_64
> >
> > The following bash script demonstrates the problem (run under root):
> >
> > ```
> > #!/bin/bash
> >
> > set -e -u -x
> >
> > # Some cleanups
> > ip netns delete myspace || :
> > ip link del qweqwe1 || :
> >
> > # The bug happens only with physical interfaces, not with, say, dummy one
> > ip link property add dev enp0s20f0u2 altname myname
> > ip netns add myspace
> > ip link set enp0s20f0u2 netns myspace
> >
> > # add dummy interface + set the same altname as in background namespace.
> > ip link add name qweqwe1 type dummy
> > ip link property add dev qweqwe1 altname myname
> >
> > # Trigger the bug. The kernel will try to return ethernet interface
> > back to root namespace, but it can not, because of conflicting
> > altnames.
> > ip netns delete myspace
> >
> > # now `ip link` will hang forever !!!!!
> > ```
> >
> > I think, the problem is obvious. Althougn I don't know how to fix.
> > Remove conflicting altnames for interfaces that returns from killed
> > namespaces ?
>
> As this can only be triggered by root, not much for us to do here,
> perhaps discuss it on the netdev mailing list for all network developers
> to work on?
>
> > On kernel 6.3.8 (at least) was another bug, that allows dulicate
> > altnames, and it was fixed mainline somewhere. I have another script
> > to trigger the bug on these old kernels. I did not bisect.
>
> If this is an issue on 6.1.y, that would be good to know so that we can
> try to fix the issue there if bisection can find it.  Care to share the
> script so that I can test?
>
> thanks,
>
> greg k-h



-- 
Segmentation fault