> From: Denis V. Lunev <[email protected]> > > ip6_tnl_init_net() frees the ip6_tnl_net of a netns whose VE lacks > VE_FEATURE_IPIP. Only the fallback ip6tnl0 is netns_immutable, so the > host can move any other ip6tnl tunnel into such a container with > "ip link set t6 netns <CT>". ip6_tnl_dellink() looks ip6n up in > dev_net(dev) and reads ip6n->fb_tnl_dev, so the node panics on a NULL > pointer dereference when container root deletes the tunnel, when the > container stops and cleanup_net() deletes it, or when ip6_tunnel is > unloaded. > > Take ip6n from t->net, the netns the tunnel was created in and is > hashed in, as changelink, uninit and the ioctl path already do. The > fallback device cannot leave its netns, so the fb_tnl_dev comparison > keeps its meaning. > > Fixes: 94e61c310587 ("net/ip6ip: Consider VE_FEATURE_IPIP on new net > creation") > > https://virtuozzo.atlassian.net/browse/VSTOR-154346 > Feature: ve: per-CT features management > Signed-off-by: Denis V. Lunev <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.vzint.dev/#/patchset/[email protected]?part=1 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
