> From: Denis V. Lunev <[email protected]> > > vti6_init_net() frees the vti6_net of every container netns. vti6 > tunnels cannot be created in a container, but the host can move one in > with "ip link set v6 netns <CT>". vti6_dellink() and > vti6_siocdevprivate() look ip6n up in dev_net(dev) and read > ip6n->fb_tnl_dev, so the node panics on a NULL pointer dereference when > container root deletes the tunnel or issues a tunnel ioctl on it, when > the container stops and cleanup_net() deletes it, or when ip6_vti is > unloaded. SIOCADDTUNNEL on such a device also walks the NULL hash in > vti6_locate(). > > Take the netns from t->net in both, as ip6_tunnel and sit do. For a > tunnel that was not moved t->net is dev_net(dev), so the host sees no > change. For a moved one the CAP_NET_ADMIN checks of the ioctls now run > against the creation netns and container root gets EPERM, as it does > for ip6tnl and sit; "ip link del" keeps working. > > This relies on the backports of mainline 11b326fb0a37 ("ip6: vti: Use > ip6_tnl.net in vti6_changelink()."), which moves vti6_changelink() and > vti6_update() to t->net, and d289d5307762 ("ip6_vti: set > netns_immutable on the fallback device."), which keeps ip6_vti0 in its > netns so the fb_tnl_dev comparisons keep their meaning. > > Fixes: b03d021d2fd6 ("ve/net: ip6_vti: skip per net init in ve") > > https://virtuozzo.atlassian.net/browse/VSTOR-154348 > Feature: net: whitelist allowed Container network devices > Signed-off-by: Denis V. Lunev <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.vzint.dev/#/patchset/[email protected]?part=6 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
