• Florian Westphal's avatar
    netns: add and use net_ns_barrier · 7866cc57
    Florian Westphal authored
    Quoting Joe Stringer:
      If a user loads nf_conntrack_ftp, sends FTP traffic through a network
      namespace, destroys that namespace then unloads the FTP helper module,
      then the kernel will crash.
    
    Events that lead to the crash:
    1. conntrack is created with ftp helper in netns x
    2. This netns is destroyed
    3. netns destruction is scheduled
    4. netns destruction wq starts, removes netns from global list
    5. ftp helper is unloaded, which resets all helpers of the conntracks
    via for_each_net()
    
    but because netns is already gone from list the for_each_net() loop
    doesn't include it, therefore all of these conntracks are unaffected.
    
    6. helper module unload finishes
    7. netns wq invokes destructor for rmmod'ed helper
    
    CC: "Eric W. Biederman" <ebiederm@xmission.com>
    Reported-by: default avatarJoe Stringer <joe@ovn.org>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
    Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    7866cc57
net_namespace.h 9.31 KB