On Wed, Jul 19, 2017 at 12:56 AM, Sabrina Dubroca <[email protected]> wrote: > When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is > called first, removing /proc/net/ipt_CLUSTERIP. > Then clusterip_config_entry_put() is called from clusterip_tg_destroy(), > and tries to remove its entry under /proc/net/ipt_CLUSTERIP/. > > Fix this by checking that the parent directory of the entry to remove > hasn't already been deleted. > > The following triggers a KASAN splat (stealing the reproducer from > 202f59afd441, thanks to Jianlin Shi and Xin Long): > > ip netns add test > ip link add veth0_in type veth peer name veth0_out > ip link set veth0_in netns test > ip netns exec test ip link set lo up > ip netns exec test ip link set veth0_in up > ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j \ > CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \ > --local-node 1 --hashmode sourceip-sourceport > ip netns del test > > Fixes: ce4ff76c15a8 ("netfilter: ipt_CLUSTERIP: make proc directory per net > namespace") > Signed-off-by: Sabrina Dubroca <[email protected]>
Reviewed-by: Xin Long <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
