mirror of
https://github.com/torvalds/linux.git
synced 2024-12-03 09:31:26 +00:00
ebaf39e603
The *_frag_reasm() functions are susceptible to miscalculating the byte count of packet fragments in case the truesize of a head buffer changes. The truesize member may be changed by the call to skb_unclone(), leaving the fragment memory limit counter unbalanced even if all fragments are processed. This miscalculation goes unnoticed as long as the network namespace which holds the counter is not destroyed. Should an attempt be made to destroy a network namespace that holds an unbalanced fragment memory limit counter the cleanup of the namespace never finishes. The thread handling the cleanup gets stuck in inet_frags_exit_net() waiting for the percpu counter to reach zero. The thread is usually in running state with a stacktrace similar to: PID: 1073 TASK: ffff880626711440 CPU: 1 COMMAND: "kworker/u48:4" #5 [ffff880621563d48] _raw_spin_lock at ffffffff815f5480 #6 [ffff880621563d48] inet_evict_bucket at ffffffff8158020b #7 [ffff880621563d80] inet_frags_exit_net at ffffffff8158051c #8 [ffff880621563db0] ops_exit_list at ffffffff814f5856 #9 [ffff880621563dd8] cleanup_net at ffffffff814f67c0 #10 [ffff880621563e38] process_one_work at ffffffff81096f14 It is not possible to create new network namespaces, and processes that call unshare() end up being stuck in uninterruptible sleep state waiting to acquire the net_mutex. The bug was observed in the IPv6 netfilter code by Per Sundstrom. I thank him for his analysis of the problem. The parts of this patch that apply to IPv4 and IPv6 fragment reassembly are preemptive measures. Signed-off-by: Jiri Wiesner <jwiesner@suse.com> Reported-by: Per Sundstrom <per.sundstrom@redqube.se> Acked-by: Peter Oskolkov <posk@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| ip6_tables.c | ||
| ip6t_ah.c | ||
| ip6t_eui64.c | ||
| ip6t_frag.c | ||
| ip6t_hbh.c | ||
| ip6t_ipv6header.c | ||
| ip6t_MASQUERADE.c | ||
| ip6t_mh.c | ||
| ip6t_NPT.c | ||
| ip6t_REJECT.c | ||
| ip6t_rpfilter.c | ||
| ip6t_rt.c | ||
| ip6t_srh.c | ||
| ip6t_SYNPROXY.c | ||
| ip6table_filter.c | ||
| ip6table_mangle.c | ||
| ip6table_nat.c | ||
| ip6table_raw.c | ||
| ip6table_security.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_reasm.c | ||
| nf_defrag_ipv6_hooks.c | ||
| nf_dup_ipv6.c | ||
| nf_flow_table_ipv6.c | ||
| nf_log_ipv6.c | ||
| nf_nat_l3proto_ipv6.c | ||
| nf_nat_masquerade_ipv6.c | ||
| nf_nat_proto_icmpv6.c | ||
| nf_reject_ipv6.c | ||
| nf_socket_ipv6.c | ||
| nf_tproxy_ipv6.c | ||
| nft_chain_nat_ipv6.c | ||
| nft_chain_route_ipv6.c | ||
| nft_dup_ipv6.c | ||
| nft_fib_ipv6.c | ||
| nft_masq_ipv6.c | ||
| nft_redir_ipv6.c | ||
| nft_reject_ipv6.c | ||