In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().<\/p>\n
syzbot reported the warning in cfg80211_pernet_exit(). [0]<\/p>\n
The repro does the following:<\/p>\n
1. create two device in root netns and non-root netns
\n 2. assign the same altname for the two devices
\n 3. remove the non-root netns<\/p>\n
Since commit 7663d522099e (“net: check for altname conflicts
\nwhen changing netdev’s netns”), cfg80211_switch_netns() and
\ncfg802154_switch_netns() fail if init_net has a device with the
\nconflicting altname.<\/p>\n
default_device_exit_net() had the same issue and commit d09486a04f5d
\n(“net: fix removing a namespace with conflicting altnames”) fixed it.<\/p>\n
cfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.<\/p>\n
Let’s generalise the fix by removing conflicting altnames for dying
\nnetns in __dev_change_net_namespace().<\/p>\n
[0]:
\ncfg80211_switch_netns(rdev, &init_net)
\nWARNING: net\/wireless\/core.c:1871 at cfg80211_pernet_exit+0xd5\/0x120 net\/wireless\/core.c:1871, CPU#1: kworker\/u8:9\/1160
\nModules linked in:
\nCPU: 1 UID: 0 PID: 1160 Comm: kworker\/u8:9 Not tainted syzkaller #0 PREEMPT(full)
\nHardware name: Google Google Compute Engine\/Google Compute Engine, BIOS Google 07\/24\/2026
\nWorkqueue: netns cleanup_net
\nRIP: 0010:cfg80211_pernet_exit+0xd5\/0x120 net\/wireless\/core.c:1871
\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e
\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293
\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000
\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000
\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000
\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20
\nFS: 0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0
\nCall Trace:<\/p>\n
ops_exit_list net\/core\/net_namespace.c:200 [inline]
\n ops_undo_list+0x43d\/0x8d0 net\/core\/net_namespace.c:253
\n cleanup_net+0x572\/0x810 net\/core\/net_namespace.c:706
\n process_one_work kernel\/workqueue.c:3387 [inline]
\n process_scheduled_works+0xc3d\/0x1630 kernel\/workqueue.c:3470
\n worker_thread+0xa47\/0xfb0 kernel\/workqueue.c:3551
\n kthread+0x38b\/0x480 kernel\/kthread.c:436
\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().<\/p>\n
syzbot reported the warning in cfg80211_pernet_e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29228","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}