oss-security - CVE request: ipv4: Don't do expensive useless work during inetdev destroy

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <56E80973.80606@virtuozzo.com>
Date: Tue, 15 Mar 2016 16:09:07 +0300
From: Vasily Averin <vvs@...tuozzo.com>
To: oss-security@...ts.openwall.com
Cc: Solar Designer <solar@...nwall.com>,
        Cyrill Gorcunov <gorcunov@...tuozzo.com>,
        "David S. Miller" <davem@...emloft.net>,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: CVE request: ipv4: Don't do expensive useless work during inetdev
 destroy

Destroy of network interface with huge number of ipv4 addresses
keeps rtnl_lock for a very long time (up to hour).
It blocks many network related operations,
including for example creation of new incoming ssh connections.

The problem is especially important for containers,
container owner have enough permission to enable this trigger
and then can block network access on whole host node.

The problem is fixed in net-next git by patch fbd40ea0180a2d328c5adc61414dc8bab9335ce2
(http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/patch/?id=fbd40ea0180a2d328c5adc61414dc8bab9335ce2)

From: David Miller <davem@...emloft.net>
ipv4: Don't do expensive useless work during inetdev destroy.

When an inetdev is destroyed, every address assigned to the interface
is removed.  And in this scenerio we do two pointless things which can
be very expensive if the number of assigned interfaces is large:

1) Address promotion.  We are deleting all addresses, so there is no
   point in doing this.

2) A full nf conntrack table purge for every address.  We only need to
   do this once, as is already caught by the existing
   masq_dev_notifier so masq_inet_event() can skip this.

Reported-by: Solar Designer <solar@...nwall.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
Tested-by: Cyrill Gorcunov <gorcunov@...nvz.org>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.