netns: Fix crash by making igmp per namespace
This patch makes the multicast socket to be per namespace.
When a network namespace is created, other than the init_net and a
multicast packet is received, the kernel goes to a hang or a kernel panic.
How to reproduce ?
* create a child network namespace
* create a pair virtual device veth
* ip link add type veth
* move one side to the pair network device to the child namespace
* ip link set netns <childpid> dev veth1
* ping -I veth0 224.0.0.1
The bug appears because the function ip_mc_init_dev does not initialize
the different multicast fields as it exits because it is not the init_net.
BUG: soft lockup - CPU#0 stuck for 61s! [avahi-daemon:2695]
Modules linked in:
irq event stamp: 50350
hardirqs last enabled at (50349): [<c03ee949>] _spin_unlock_irqrestore+0x34/0x39
hardirqs last disabled at (50350): [<c03ec639>] schedule+0x9f/0x5ff
softirqs last enabled at (45712): [<c0374d4b>] ip_setsockopt+0x8e7/0x909
softirqs last disabled at (45710): [<c03ee682>] _spin_lock_bh+0x8/0x27
Pid: 2695, comm: avahi-daemon Not tainted (2.6.27-rc2-00029-g0872073 #3)
EIP: 0060:[<c03ee47c>] EFLAGS: 00000297 CPU: 0
EIP is at __read_lock_failed+0x8/0x10
EAX: c4f38810 EBX: c4f38810 ECX: 00000000 EDX: c04cc22e
ESI: fb0000e0 EDI: 00000011 EBP: 0f02000a ESP: c4e3faa0
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
CR0: 8005003b CR2: 44618a40 CR3: 04e37000 CR4: 000006d0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
[<c02311f8>] ? _raw_read_lock+0x23/0x25
[<c0390666>] ? ip_check_mc+0x1c/0x83
[<c036d478>] ? ip_route_input+0x229/0xe92
[<c022e2e4>] ? trace_hardirqs_on_thunk+0xc/0x10
[<c0104c9c>] ? do_IRQ+0x69/0x7d
[<c0102e64>] ? restore_nocheck_notrace+0x0/0xe
[<c036fdba>] ? ip_rcv+0x227/0x505
[<c0358764>] ? netif_receive_skb+0xfe/0x2b3
[<c03588d2>] ? netif_receive_skb+0x26c/0x2b3
[<c035af31>] ? process_backlog+0x73/0xbd
[<c035a8cd>] ? net_rx_action+0xc1/0x1ae
[<c01218a8>] ? __do_softirq+0x7b/0xef
[<c0121953>] ? do_softirq+0x37/0x4d
[<c035b50d>] ? dev_queue_xmit+0x3d4/0x40b
[<c0122037>] ? local_bh_enable+0x96/0xab
[<c035b50d>] ? dev_queue_xmit+0x3d4/0x40b
[<c012181e>] ? _local_bh_enable+0x79/0x88
[<c035fcb8>] ? neigh_resolve_output+0x20f/0x239
[<c0373118>] ? ip_finish_output+0x1df/0x209
[<c0373364>] ? ip_dev_loopback_xmit+0x62/0x66
[<c0371db5>] ? ip_local_out+0x15/0x17
[<c0372013>] ? ip_push_pending_frames+0x25c/0x2bb
[<c03891b8>] ? udp_push_pending_frames+0x2bb/0x30e
[<c038a189>] ? udp_sendmsg+0x413/0x51d
[<c038a1a9>] ? udp_sendmsg+0x433/0x51d
[<c038f927>] ? inet_sendmsg+0x35/0x3f
[<c034f092>] ? sock_sendmsg+0xb8/0xd1
[<c012d554>] ? autoremove_wake_function+0x0/0x2b
[<c022e6de>] ? copy_from_user+0x32/0x5e
[<c022e6de>] ? copy_from_user+0x32/0x5e
[<c034f238>] ? sys_sendmsg+0x18d/0x1f0
[<c0175e90>] ? pipe_write+0x3cb/0x3d7
[<c0170347>] ? do_sync_write+0xbe/0x105
[<c012d554>] ? autoremove_wake_function+0x0/0x2b
[<c03503b2>] ? sys_socketcall+0x176/0x1b0
[<c01085ea>] ? syscall_trace_enter+0x6c/0x7b
[<c0102e1a>] ? syscall_call+0x7/0xb
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Daniel Lezcano
David S. Miller
parent
1bb5bd2c71
commit
877acedc0d
|
|
@ -289,6 +289,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
|
|||
struct rtable *rt;
|
||||
struct iphdr *pip;
|
||||
struct igmpv3_report *pig;
|
||||
struct net *net = dev_net(dev);
|
||||
|
||||
skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
|
||||
if (skb == NULL)
|
||||
|
|
@ -299,7 +300,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
|
|||
.nl_u = { .ip4_u = {
|
||||
.daddr = IGMPV3_ALL_MCR } },
|
||||
.proto = IPPROTO_IGMP };
|
||||
if (ip_route_output_key(&init_net, &rt, &fl)) {
|
||||
if (ip_route_output_key(net, &rt, &fl)) {
|
||||
kfree_skb(skb);
|
||||
return NULL;
|
||||
}
|
||||
|
|
@ -629,6 +630,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
|
|||
struct igmphdr *ih;
|
||||
struct rtable *rt;
|
||||
struct net_device *dev = in_dev->dev;
|
||||
struct net *net = dev_net(dev);
|
||||
__be32 group = pmc ? pmc->multiaddr : 0;
|
||||
__be32 dst;
|
||||
|
||||
|
|
@ -643,7 +645,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
|
|||
struct flowi fl = { .oif = dev->ifindex,
|
||||
.nl_u = { .ip4_u = { .daddr = dst } },
|
||||
.proto = IPPROTO_IGMP };
|
||||
if (ip_route_output_key(&init_net, &rt, &fl))
|
||||
if (ip_route_output_key(net, &rt, &fl))
|
||||
return -1;
|
||||
}
|
||||
if (rt->rt_src == 0) {
|
||||
|
|
@ -1196,9 +1198,6 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
|
|||
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
for (im=in_dev->mc_list; im; im=im->next) {
|
||||
if (im->multiaddr == addr) {
|
||||
im->users++;
|
||||
|
|
@ -1278,9 +1277,6 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
|
|||
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
|
||||
if (i->multiaddr==addr) {
|
||||
if (--i->users == 0) {
|
||||
|
|
@ -1308,9 +1304,6 @@ void ip_mc_down(struct in_device *in_dev)
|
|||
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
for (i=in_dev->mc_list; i; i=i->next)
|
||||
igmp_group_dropped(i);
|
||||
|
||||
|
|
@ -1331,9 +1324,6 @@ void ip_mc_init_dev(struct in_device *in_dev)
|
|||
{
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
in_dev->mc_tomb = NULL;
|
||||
#ifdef CONFIG_IP_MULTICAST
|
||||
in_dev->mr_gq_running = 0;
|
||||
|
|
@ -1357,9 +1347,6 @@ void ip_mc_up(struct in_device *in_dev)
|
|||
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
|
||||
|
||||
for (i=in_dev->mc_list; i; i=i->next)
|
||||
|
|
@ -1376,9 +1363,6 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
|
|||
|
||||
ASSERT_RTNL();
|
||||
|
||||
if (!net_eq(dev_net(in_dev->dev), &init_net))
|
||||
return;
|
||||
|
||||
/* Deactivate timers */
|
||||
ip_mc_down(in_dev);
|
||||
|
||||
|
|
@ -1395,7 +1379,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
|
|||
write_unlock_bh(&in_dev->mc_list_lock);
|
||||
}
|
||||
|
||||
static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
|
||||
static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
|
||||
{
|
||||
struct flowi fl = { .nl_u = { .ip4_u =
|
||||
{ .daddr = imr->imr_multiaddr.s_addr } } };
|
||||
|
|
@ -1404,19 +1388,19 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
|
|||
struct in_device *idev = NULL;
|
||||
|
||||
if (imr->imr_ifindex) {
|
||||
idev = inetdev_by_index(&init_net, imr->imr_ifindex);
|
||||
idev = inetdev_by_index(net, imr->imr_ifindex);
|
||||
if (idev)
|
||||
__in_dev_put(idev);
|
||||
return idev;
|
||||
}
|
||||
if (imr->imr_address.s_addr) {
|
||||
dev = ip_dev_find(&init_net, imr->imr_address.s_addr);
|
||||
dev = ip_dev_find(net, imr->imr_address.s_addr);
|
||||
if (!dev)
|
||||
return NULL;
|
||||
dev_put(dev);
|
||||
}
|
||||
|
||||
if (!dev && !ip_route_output_key(&init_net, &rt, &fl)) {
|
||||
if (!dev && !ip_route_output_key(net, &rt, &fl)) {
|
||||
dev = rt->u.dst.dev;
|
||||
ip_rt_put(rt);
|
||||
}
|
||||
|
|
@ -1754,18 +1738,16 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
|
|||
struct ip_mc_socklist *iml=NULL, *i;
|
||||
struct in_device *in_dev;
|
||||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct net *net = sock_net(sk);
|
||||
int ifindex;
|
||||
int count = 0;
|
||||
|
||||
if (!ipv4_is_multicast(addr))
|
||||
return -EINVAL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
|
||||
in_dev = ip_mc_find_dev(imr);
|
||||
in_dev = ip_mc_find_dev(net, imr);
|
||||
|
||||
if (!in_dev) {
|
||||
iml = NULL;
|
||||
|
|
@ -1827,15 +1809,13 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
|
|||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct ip_mc_socklist *iml, **imlp;
|
||||
struct in_device *in_dev;
|
||||
struct net *net = sock_net(sk);
|
||||
__be32 group = imr->imr_multiaddr.s_addr;
|
||||
u32 ifindex;
|
||||
int ret = -EADDRNOTAVAIL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
in_dev = ip_mc_find_dev(imr);
|
||||
in_dev = ip_mc_find_dev(net, imr);
|
||||
ifindex = imr->imr_ifindex;
|
||||
for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
|
||||
if (iml->multi.imr_multiaddr.s_addr != group)
|
||||
|
|
@ -1873,21 +1853,19 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
|
|||
struct in_device *in_dev = NULL;
|
||||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct ip_sf_socklist *psl;
|
||||
struct net *net = sock_net(sk);
|
||||
int leavegroup = 0;
|
||||
int i, j, rv;
|
||||
|
||||
if (!ipv4_is_multicast(addr))
|
||||
return -EINVAL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
|
||||
imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
|
||||
imr.imr_address.s_addr = mreqs->imr_interface;
|
||||
imr.imr_ifindex = ifindex;
|
||||
in_dev = ip_mc_find_dev(&imr);
|
||||
in_dev = ip_mc_find_dev(net, &imr);
|
||||
|
||||
if (!in_dev) {
|
||||
err = -ENODEV;
|
||||
|
|
@ -2007,6 +1985,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
|
|||
struct in_device *in_dev;
|
||||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct ip_sf_socklist *newpsl, *psl;
|
||||
struct net *net = sock_net(sk);
|
||||
int leavegroup = 0;
|
||||
|
||||
if (!ipv4_is_multicast(addr))
|
||||
|
|
@ -2015,15 +1994,12 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
|
|||
msf->imsf_fmode != MCAST_EXCLUDE)
|
||||
return -EINVAL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
|
||||
imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
|
||||
imr.imr_address.s_addr = msf->imsf_interface;
|
||||
imr.imr_ifindex = ifindex;
|
||||
in_dev = ip_mc_find_dev(&imr);
|
||||
in_dev = ip_mc_find_dev(net, &imr);
|
||||
|
||||
if (!in_dev) {
|
||||
err = -ENODEV;
|
||||
|
|
@ -2094,19 +2070,17 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
|
|||
struct in_device *in_dev;
|
||||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct ip_sf_socklist *psl;
|
||||
struct net *net = sock_net(sk);
|
||||
|
||||
if (!ipv4_is_multicast(addr))
|
||||
return -EINVAL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
|
||||
imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
|
||||
imr.imr_address.s_addr = msf->imsf_interface;
|
||||
imr.imr_ifindex = 0;
|
||||
in_dev = ip_mc_find_dev(&imr);
|
||||
in_dev = ip_mc_find_dev(net, &imr);
|
||||
|
||||
if (!in_dev) {
|
||||
err = -ENODEV;
|
||||
|
|
@ -2163,9 +2137,6 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
|
|||
if (!ipv4_is_multicast(addr))
|
||||
return -EINVAL;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return -EPROTONOSUPPORT;
|
||||
|
||||
rtnl_lock();
|
||||
|
||||
err = -EADDRNOTAVAIL;
|
||||
|
|
@ -2246,19 +2217,17 @@ void ip_mc_drop_socket(struct sock *sk)
|
|||
{
|
||||
struct inet_sock *inet = inet_sk(sk);
|
||||
struct ip_mc_socklist *iml;
|
||||
struct net *net = sock_net(sk);
|
||||
|
||||
if (inet->mc_list == NULL)
|
||||
return;
|
||||
|
||||
if (!net_eq(sock_net(sk), &init_net))
|
||||
return;
|
||||
|
||||
rtnl_lock();
|
||||
while ((iml = inet->mc_list) != NULL) {
|
||||
struct in_device *in_dev;
|
||||
inet->mc_list = iml->next;
|
||||
|
||||
in_dev = inetdev_by_index(&init_net, iml->multi.imr_ifindex);
|
||||
in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
|
||||
(void) ip_mc_leave_src(sk, iml, in_dev);
|
||||
if (in_dev != NULL) {
|
||||
ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
|
||||
|
|
|
|||
Loading…
Reference in a new issue