CVE-2021-47266

RDMA/ipoib: Fix warning caused by destroying non-initial netns

published May 21, 2024

CVSS
—
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ipoib: Fix warning caused by destroying non-initial netns

After the commit 5ce2dced8e95 ("RDMA/ipoib: Set rtnl_link_ops for ipoib

interfaces"), if the IPoIB device is moved to non-initial netns,

destroying that netns lets the device vanish instead of moving it back to

the initial netns, This is happening because default_device_exit() skips

the interfaces due to having rtnl_link_ops set.

Steps to reporoduce:

ip netns add foo

ip link set mlx5_ib0 netns foo

ip netns delete foo

WARNING: CPU: 1 PID: 704 at net/core/dev.c:11435 netdev_exit+0x3f/0x50

Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT

nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack

nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun d

fuse

CPU: 1 PID: 704 Comm: kworker/u64:3 Tainted: G S W 5.13.0-rc1+ #1

Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016

Workqueue: netns cleanup_net

RIP: 0010:netdev_exit+0x3f/0x50

Code: 48 8b bb 30 01 00 00 e8 ef 81 b1 ff 48 81 fb c0 3a 54 a1 74 13 48

8b 83 90 00 00 00 48 81 c3 90 00 00 00 48 39 d8 75 02 5b c3 <0f> 0b 5b

c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00

RSP: 0018:ffffb297079d7e08 EFLAGS: 00010206

RAX: ffff8eb542c00040 RBX: ffff8eb541333150 RCX: 000000008010000d

RDX: 000000008010000e RSI: 000000008010000d RDI: ffff8eb440042c00

RBP: ffffb297079d7e48 R08: 0000000000000001 R09: ffffffff9fdeac00

R10: ffff8eb5003be000 R11: 0000000000000001 R12: ffffffffa1545620

R13: ffffffffa1545628 R14: 0000000000000000 R15: ffffffffa1543b20

FS: 0000000000000000(0000) GS:ffff8ed37fa00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00005601b5f4c2e8 CR3: 0000001fc8c10002 CR4: 00000000003706e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:

ops_exit_list.isra.9+0x36/0x70

cleanup_net+0x234/0x390

process_one_work+0x1cb/0x360

? process_one_work+0x360/0x360

worker_thread+0x30/0x370

? process_one_work+0x360/0x360

kthread+0x116/0x130

? kthread_park+0x80/0x80

ret_from_fork+0x22/0x30

To avoid the above warning and later on the kernel panic that could happen

on shutdown due to a NULL pointer dereference, make sure to set the

netns_refund flag that was introduced by commit 3a5ca857079e ("can: dev:

Move device back to init netns on owning netns delete") to properly

restore the IPoIB interfaces to the initial netns.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.3th percentile
Published
2024-05-21T14:19Z
EPSS history
Timeline
  • 21 MAY 14:19Z
    RDMA/ipoib: Fix warning caused by destroying non-initial netns
    cvelistv5