Commit 7866cc57 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netns: add and use net_ns_barrier

Quoting Joe Stringer:
  If a user loads nf_conntrack_ftp, sends FTP traffic through a network
  namespace, destroys that namespace then unloads the FTP helper module,
  then the kernel will crash.

Events that lead to the crash:
1. conntrack is created with ftp helper in netns x
2. This netns is destroyed
3. netns destruction is scheduled
4. netns destruction wq starts, removes netns from global list
5. ftp helper is unloaded, which resets all helpers of the conntracks
via for_each_net()

but because netns is already gone from list the for_each_net() loop
doesn't include it, therefore all of these conntracks are unaffected.

6. helper module unload finishes
7. netns wq invokes destructor for rmmod'ed helper

CC: "Eric W. Biederman" <ebiederm@xmission.com>
Reported-by: default avatarJoe Stringer <joe@ovn.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2c41f33c
...@@ -158,6 +158,7 @@ extern struct net init_net; ...@@ -158,6 +158,7 @@ extern struct net init_net;
struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns, struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns,
struct net *old_net); struct net *old_net);
void net_ns_barrier(void);
#else /* CONFIG_NET_NS */ #else /* CONFIG_NET_NS */
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/nsproxy.h> #include <linux/nsproxy.h>
...@@ -168,6 +169,8 @@ static inline struct net *copy_net_ns(unsigned long flags, ...@@ -168,6 +169,8 @@ static inline struct net *copy_net_ns(unsigned long flags,
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
return old_net; return old_net;
} }
static inline void net_ns_barrier(void) {}
#endif /* CONFIG_NET_NS */ #endif /* CONFIG_NET_NS */
......
...@@ -482,6 +482,23 @@ static void cleanup_net(struct work_struct *work) ...@@ -482,6 +482,23 @@ static void cleanup_net(struct work_struct *work)
net_drop_ns(net); net_drop_ns(net);
} }
} }
/**
* net_ns_barrier - wait until concurrent net_cleanup_work is done
*
* cleanup_net runs from work queue and will first remove namespaces
* from the global list, then run net exit functions.
*
* Call this in module exit path to make sure that all netns
* ->exit ops have been invoked before the function is removed.
*/
void net_ns_barrier(void)
{
mutex_lock(&net_mutex);
mutex_unlock(&net_mutex);
}
EXPORT_SYMBOL(net_ns_barrier);
static DECLARE_WORK(net_cleanup_work, cleanup_net); static DECLARE_WORK(net_cleanup_work, cleanup_net);
void __put_net(struct net *net) void __put_net(struct net *net)
......
...@@ -1720,6 +1720,8 @@ EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup_net); ...@@ -1720,6 +1720,8 @@ EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup_net);
* Like nf_ct_iterate_cleanup, but first marks conntracks on the * Like nf_ct_iterate_cleanup, but first marks conntracks on the
* unconfirmed list as dying (so they will not be inserted into * unconfirmed list as dying (so they will not be inserted into
* main table). * main table).
*
* Can only be called in module exit path.
*/ */
void void
nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data) nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data)
...@@ -1734,6 +1736,13 @@ nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data) ...@@ -1734,6 +1736,13 @@ nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data)
} }
rtnl_unlock(); rtnl_unlock();
/* Need to wait for netns cleanup worker to finish, if its
* running -- it might have deleted a net namespace from
* the global list, so our __nf_ct_unconfirmed_destroy() might
* not have affected all namespaces.
*/
net_ns_barrier();
/* a conntrack could have been unlinked from unconfirmed list /* a conntrack could have been unlinked from unconfirmed list
* before we grabbed pcpu lock in __nf_ct_unconfirmed_destroy(). * before we grabbed pcpu lock in __nf_ct_unconfirmed_destroy().
* This makes sure its inserted into conntrack table. * This makes sure its inserted into conntrack table.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment