github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-30 22:53:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
aa5e44b29f
linux/net/core
History
Kuniyuki Iwashima debac3a20d net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 
syzbot reported the warning in cfg80211_pernet_exit(). [0]

The repro does the following:

  1. create two device in root netns and non-root netns
  2. assign the same altname for the two devices
  3. remove the non-root netns

Since commit 7663d52209 ("net: check for altname conflicts
when changing netdev's netns"), cfg80211_switch_netns() and
cfg802154_switch_netns() fail if init_net has a device with the
conflicting altname.

default_device_exit_net() had the same issue and commit d09486a04f
("net: fix removing a namespace with conflicting altnames") fixed it.

cfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.

Let's generalise the fix by removing conflicting altnames for dying
netns in __dev_change_net_namespace().

[0]:
cfg80211_switch_netns(rdev, &init_net)
WARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160
Modules linked in:
CPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
RIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871
Code: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 <0f> 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e
RSP: 0018:ffffc900057a78f0 EFLAGS: 00010293
RAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000
RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
RBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000
R10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000
R13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20
FS:  0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253
 cleanup_net+0x572/0x810 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Fixes: 36fbf1e52b ("net: rtnetlink: add linkprop commands to add and delete alternative ifnames")
Reported-by: syzbot+74f338e09f1ef3ee6457@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260901005550.2042357-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-02 18:30:00 -07:00
..
bpf_ksock.c bpf: Add ksock kfuncs 2026-08-15 23:36:18 +02:00
bpf_sk_storage.c bpf: Fix UAF in sock clone early bailouts 2026-07-09 18:44:16 +02:00
datagram.c net: devmem: prevent net-iov / page mixing 2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c net: cache snapshot entries for ndo_set_rx_mode_async 2026-04-21 12:50:13 +02:00
dev_addr_lists.c net: turn the rx_mode work into a generic netdev_work facility 2026-06-25 10:18:40 -07:00
dev_api.c net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
dev_ioctl.c net: ethtool: make dev->hwprov ops-protected 2026-06-09 10:13:04 -07:00
dev.c net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 2026-09-02 18:30:00 -07:00
dev.h net: avoid theoretical races with ref drain 2026-08-06 09:37:03 -07:00
devmem.c net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
devmem.h net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
drop_monitor.c drop_monitor: perform u64_stats updates under IRQ-disabled section 2026-07-23 11:00:01 -07:00
dst_cache.c net: dst: annotate data-races around dst->obsolete 2025-07-02 14:32:29 -07:00
dst.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
failover.c net: failover: check register_netdevice_notifier() error in failover_init() 2026-08-04 18:46:34 -07:00
fib_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib_rules.c net: fib_rules: Destroy ops->lock in fib_rules_unregister(). 2026-07-07 10:51:06 +02:00
filter.c bpf: Clear decap state on skb_adjust_room shrink path 2026-08-17 11:30:13 +02:00
flow_dissector.c flow_dissector: check device type before reading ETH_ADDRS 2026-06-18 18:07:00 -07:00
flow_offload.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
gen_estimator.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
gen_stats.c net/sched: add const qualifiers to gnet_stats helpers 2026-05-11 18:28:08 -07:00
gro_cells.c net: iptunnel: fix stale transport header during tunnel decapsulation 2026-08-28 15:53:46 -07:00
gro.c net: gro: fix double aggregation of flush-marked skbs 2026-07-21 08:30:54 -07:00
gso.c
hotdata.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
hwbm.c
ieee8021q_helpers.c net: ieee8021q: fix insufficient table-size assertion 2025-07-01 12:55:49 +02:00
link_watch.c net: rename netdev_ops_assert_locked() 2026-06-04 14:04:55 -07:00
lock_debug.c net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers 2026-07-07 15:31:37 +02:00
lwt_bpf.c lwt_bpf: Restore reserved headroom after xmit program 2026-08-17 10:59:03 +02:00
lwtunnel.c net: lwtunnel: Drop skb metadata before LWT encapsulation 2026-06-23 19:07:23 -07:00
Makefile bpf: Add ksock kfuncs 2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c neighbour: remove obsolete EXPORT_SYMBOL() 2026-06-08 15:59:17 -07:00
net_namespace.c net: fix a resource leak in copy_net_ns() error handling path 2026-08-25 12:30:55 +02:00
net_test.c
net-procfs.c net: add proper RCU protection to /proc/net/ptype 2026-02-03 19:20:30 -08:00
net-sysfs.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc 2026-08-17 10:27:48 -07:00
net-sysfs.h net: Defer netdev KOBJ_ADD uevent until the device is published 2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netdev_config.c net: add queue config validation callback 2026-01-23 11:49:02 -08:00
netdev_queues.c net: expect instance lock in netdev_queue_get_dma_dev() 2026-08-10 15:54:42 -07:00
netdev_rx_queue.c net: Stop leased rxq before uninstalling its memory provider 2026-06-11 15:57:39 -07:00
netdev_work.c net: avoid theoretical races with ref drain 2026-08-06 09:37:03 -07:00
netdev-genl-gen.c net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
netdev-genl-gen.h net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
netdev-genl.c netdev: check for nla_put_u32() failures 2026-08-10 16:38:40 -07:00
netevent.c
netmem_priv.h Revert "mm: introduce a new page type for page pool in page type" 2026-05-21 19:06:13 -07:00
netpoll.c netconsole: move netpoll_wait_carrier() as netcons_wait_carrier() 2026-07-30 12:14:39 +02:00
netprio_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
of_net.c
page_pool_priv.h net: page_pool: don't try to stash the napi id 2025-01-27 14:37:41 -08:00
page_pool_user.c net: make page_pool_get_stats() void 2026-05-28 18:10:03 -07:00
page_pool.c page_pool: keep frag_offset aligned for odd-sized requests 2026-08-31 16:24:51 -07:00
pktgen.c net: pktgen: use a consistent flow count 2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c rtnetlink: cap IFLA_VFINFO_LIST at a documented number of VFs 2026-08-06 12:42:49 +02:00
scm.c net: af_unix: useful handling of LSM denials on SCM_RIGHTS 2026-08-17 18:14:52 -07:00
secure_seq.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
selftests.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
skb_fault_injection.c
skbuff.c net: Guard for gso_segs overflow in skb_segment 2026-08-27 15:47:18 +02:00
skmsg.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sock_diag.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
sock_map.c bpf, sockmap: Use sock_hold() instead of refcount_inc_not_zero() in lookup 2026-08-17 10:22:19 +02:00
sock_reuseport.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
sock.c net: psp: do not inherit the Rx association on clone 2026-09-01 15:12:24 +02:00
stream.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
sysctl_net_core.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
timestamping.c net: Add the possibility to support a selected hwtstamp in netdevice 2024-12-16 12:51:40 +00:00
tso.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
utils.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
xdp.c xdp: fix zero-copy frame layout 2026-08-22 13:10:48 -07:00