[net] ip6_gre: fix tunnel list corruption for x-netns

Message ID 20190109095721.2778-1-olivier.matz@6wind.com
State Accepted
Delegated to: David Miller
Headers show
Series
  • [net] ip6_gre: fix tunnel list corruption for x-netns
Related show

Commit Message

Olivier Matz Jan. 9, 2019, 9:57 a.m.
In changelink ops, the ip6gre_net pointer is retrieved from
dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not
unlinked from its current list and is relinked into another net
namespace. This corrupts the tunnel lists and can later trigger a kernel
oops.

Fix this by retrieving the netns from device private area.

Fixes: c8632fc30bb0 ("net: ip6_gre: Split up ip6gre_changelink()")
Cc: Petr Machata <petrm@mellanox.com>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---
 net/ipv6/ip6_gre.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

David Miller Jan. 15, 2019, 9:45 p.m. | #1
From: Olivier Matz <olivier.matz@6wind.com>
Date: Wed,  9 Jan 2019 10:57:21 +0100

> In changelink ops, the ip6gre_net pointer is retrieved from
> dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not
> unlinked from its current list and is relinked into another net
> namespace. This corrupts the tunnel lists and can later trigger a kernel
> oops.
> 
> Fix this by retrieving the netns from device private area.
> 
> Fixes: c8632fc30bb0 ("net: ip6_gre: Split up ip6gre_changelink()")
> Cc: Petr Machata <petrm@mellanox.com>
> Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
> Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

Good catch, applied and queued up for -stable.

Patch

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 09d0826742f8..f2543df50035 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2025,9 +2025,9 @@  static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
 			     struct nlattr *data[],
 			     struct netlink_ext_ack *extack)
 {
-	struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
+	struct ip6_tnl *t = netdev_priv(dev);
+	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
 	struct __ip6_tnl_parm p;
-	struct ip6_tnl *t;
 
 	t = ip6gre_changelink_common(dev, tb, data, &p, extack);
 	if (IS_ERR(t))