Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbb62978 authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by Greg Kroah-Hartman
Browse files

xfrm interface: fix list corruption for x-netns 



commit c5d1030f23002430c2a336b2b629b9d6f72b3564 upstream.

dev_net(dev) is the netns of the device and xi->net is the link netns,
where the device has been linked.
changelink() must operate in the link netns to avoid a corruption of
the xfrm lists.

Note that xi->net and dev_net(xi->physdev) are always the same.

Before the patch, the xfrmi lists may be corrupted and can later trigger a
kernel panic.

Fixes: f203b76d ("xfrm: Add virtual xfrm interfaces")
Reported-by: default avatarJulien Floret <julien.floret@6wind.com>
Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Tested-by: default avatarJulien Floret <julien.floret@6wind.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f04f067a

net/xfrm/xfrm_interface.c

+4 −4
Original line number Diff line number Diff line
@@ -505,7 +505,7 @@ static int xfrmi_change(struct xfrm_if *xi, const struct xfrm_if_parms *p) 


static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p)

{

	struct net *net = dev_net(xi->dev);

	struct net *net = xi->net;

	struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);

	int err;
@@ -674,9 +674,9 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], 
			   struct nlattr *data[],

			   struct netlink_ext_ack *extack)

{

	struct net *net = dev_net(dev);

	struct xfrm_if *xi = netdev_priv(dev);

	struct net *net = xi->net;

	struct xfrm_if_parms p;

	struct xfrm_if *xi;



	xfrmi_netlink_parms(data, &p);

	xi = xfrmi_locate(net, &p);
@@ -718,7 +718,7 @@ struct net *xfrmi_get_link_net(const struct net_device *dev) 
{

	struct xfrm_if *xi = netdev_priv(dev);



	return dev_net(xi->phydev);

	return xi->net;

}



static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {