From: Denis V. Lunev <[email protected]>
sit_init_net() frees the sit_net of a netns whose VE lacks
VE_FEATURE_SIT. Only the fallback sit0 is netns_immutable, so the host
can move any other sit tunnel into such a container with
"ip link set s6 netns <CT>". ipip6_dellink() looks sitn up in
dev_net(dev) and reads sitn->fb_tunnel_dev, so the node panics on a
NULL pointer dereference when container root deletes the tunnel, when
the container stops and cleanup_net() deletes it, or when sit is
unloaded.
Take sitn from t->net, the netns the tunnel was created in and is
hashed in, as changelink, uninit and the ioctl handlers already do. The
fallback device cannot leave its netns, so the fb_tunnel_dev comparison
keeps its meaning.
Fixes: 5aed376d130d ("net: Make sit feature optional")
https://virtuozzo.atlassian.net/browse/VSTOR-154347
Feature: ve: per-CT features management
Signed-off-by: Denis V. Lunev <[email protected]>
---
net/ipv6/sit.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 36c6c7704f84..6aec5177fa4a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1772,8 +1772,8 @@ static const struct nla_policy
ipip6_policy[IFLA_IPTUN_MAX + 1] = {
static void ipip6_dellink(struct net_device *dev, struct list_head *head)
{
- struct net *net = dev_net(dev);
- struct sit_net *sitn = net_generic(net, sit_net_id);
+ struct ip_tunnel *t = netdev_priv(dev);
+ struct sit_net *sitn = net_generic(t->net, sit_net_id);
if (dev != sitn->fb_tunnel_dev)
unregister_netdevice_queue(dev, head);
--
2.53.0
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
