[Devel] [PATCH hci-8.1] net/ip6_gre: fix a host panic adding ip6gre in a CT without ipgre

[Devel] [PATCH hci-8.1] net/ip6_gre: fix a host panic adding ip6gre in a CT without ipgre

[Denis V. Lunev]

From: Denis V. Lunev <den@openvz.org>

ip6gre_init_net() frees the ip6gre_net of a netns whose VE lacks
VE_FEATURE_IPGRE, and ip6gre_newlink_common() refuses such a netns with
-EACCES. ip6gre_newlink() and ip6erspan_newlink() reach the NULL
ip6gre_net first, through ip6gre_tunnel_find() or collect_md_tun, so
"ip link add type ip6gre" by root in an ordinary container panics the
node once ip6_gre is loaded:

  BUG: kernel NULL pointer dereference, address: 0000000000000320
  RIP: 0010:ip6gre_tunnel_find+0x46/0xd0 [ip6_gre]
   ip6gre_newlink+0x9b/0x120 [ip6_gre]

The check went into ip6gre_newlink_common(), which ran the tunnel lookup
until upstream commit b80d0b93b991 ("net: ip6_gre: fix tunnel metadata
device sharing.") moved the lookup into the newlink handlers. Move the
check to the top of both handlers. They are the only callers of
ip6gre_newlink_common() and serve as newlink for all three link types
(ip6gre, ip6gretap and ip6erspan), and nothing else in the helper uses
ip6gre_net.

Fixes: 46c13c45f25a ("net/gre: Consider VE_FEATURE_IPGRE on new net creation")

https://virtuozzo.atlassian.net/browse/VSTOR-149645
Feature: ve: per-CT features management
Signed-off-by: Denis V. Lunev <den@openvz.org>
---
 net/ipv6/ip6_gre.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 9060cb17bf25..4a0fc86d9a10 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2003,15 +2003,6 @@ static int ip6gre_newlink_common(struct net *src_net, struct net_device *dev,
 	struct ip6_tnl *nt;
 	struct ip_tunnel_encap ipencap;
 	int err;
-#ifdef CONFIG_VE
-	struct net *net = dev_net(dev);
-	struct ip6gre_net *ign;
-
-	ign = net_generic(net, ip6gre_net_id);
-
-	if (!ign) /* no VE_FEATURE_IPGRE */
-		return -EACCES;
-#endif
 
 	nt = netdev_priv(dev);
 
@@ -2048,8 +2039,13 @@ static int ip6gre_newlink(struct net *src_net, struct net_device *dev,
 	struct ip6gre_net *ign;
 	int err;
 
-	ip6gre_netlink_parms(data, &nt->parms);
 	ign = net_generic(net, ip6gre_net_id);
+#ifdef CONFIG_VE
+	if (!ign) /* no VE_FEATURE_IPGRE */
+		return -EACCES;
+#endif
+
+	ip6gre_netlink_parms(data, &nt->parms);
 
 	if (nt->parms.collect_md) {
 		if (rtnl_dereference(ign->collect_md_tun))
@@ -2284,9 +2280,14 @@ static int ip6erspan_newlink(struct net *src_net, struct net_device *dev,
 	struct ip6gre_net *ign;
 	int err;
 
+	ign = net_generic(net, ip6gre_net_id);
+#ifdef CONFIG_VE
+	if (!ign) /* no VE_FEATURE_IPGRE */
+		return -EACCES;
+#endif
+
 	ip6gre_netlink_parms(data, &nt->parms);
 	ip6erspan_set_version(data, &nt->parms);
-	ign = net_generic(net, ip6gre_net_id);
 
 	if (nt->parms.collect_md) {
 		if (rtnl_dereference(ign->collect_md_tun_erspan))
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] net/ip6_gre: fix a host panic adding ip6gre in a CT without ipgre

[no-reply]

> From: Denis V. Lunev <den@openvz.org>
> 
> ip6gre_init_net() frees the ip6gre_net of a netns whose VE lacks
> VE_FEATURE_IPGRE, and ip6gre_newlink_common() refuses such a netns with
> -EACCES. ip6gre_newlink() and ip6erspan_newlink() reach the NULL
> ip6gre_net first, through ip6gre_tunnel_find() or collect_md_tun, so
> "ip link add type ip6gre" by root in an ordinary container panics the
> node once ip6_gre is loaded:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000320
>   RIP: 0010:ip6gre_tunnel_find+0x46/0xd0 [ip6_gre]
>    ip6gre_newlink+0x9b/0x120 [ip6_gre]
> 
> The check went into ip6gre_newlink_common(), which ran the tunnel lookup
> until upstream commit b80d0b93b991 ("net: ip6_gre: fix tunnel metadata
> device sharing.") moved the lookup into the newlink handlers. Move the
> check to the top of both handlers. They are the only callers of
> ip6gre_newlink_common() and serve as newlink for all three link types
> (ip6gre, ip6gretap and ip6erspan), and nothing else in the helper uses
> ip6gre_net.
> 
> Fixes: 46c13c45f25a ("net/gre: Consider VE_FEATURE_IPGRE on new net creation")
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-149645
> Feature: ve: per-CT features management
> Signed-off-by: Denis V. Lunev <den@openvz.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261104200755.1956316-1-den@openvz.org?part=1


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel