From: Nicolas Dichtel nicolas.dichtel@6wind.com
commit c5d1030f23002430c2a336b2b629b9d6f72b3564 upstream.
dev_net(dev) is the netns of the device and xi->net is the link netns, where the device has been linked. changelink() must operate in the link netns to avoid a corruption of the xfrm lists.
Note that xi->net and dev_net(xi->physdev) are always the same.
Before the patch, the xfrmi lists may be corrupted and can later trigger a kernel panic.
Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Reported-by: Julien Floret julien.floret@6wind.com Signed-off-by: Nicolas Dichtel nicolas.dichtel@6wind.com Tested-by: Julien Floret julien.floret@6wind.com Signed-off-by: Steffen Klassert steffen.klassert@secunet.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- net/xfrm/xfrm_interface.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -505,7 +505,7 @@ static int xfrmi_change(struct xfrm_if *
static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p) { - struct net *net = dev_net(xi->dev); + struct net *net = xi->net; struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id); int err;
@@ -674,9 +674,9 @@ static int xfrmi_changelink(struct net_d struct nlattr *data[], struct netlink_ext_ack *extack) { - struct net *net = dev_net(dev); + struct xfrm_if *xi = netdev_priv(dev); + struct net *net = xi->net; struct xfrm_if_parms p; - struct xfrm_if *xi;
xfrmi_netlink_parms(data, &p); xi = xfrmi_locate(net, &p); @@ -718,7 +718,7 @@ struct net *xfrmi_get_link_net(const str { struct xfrm_if *xi = netdev_priv(dev);
- return dev_net(xi->phydev); + return xi->net; }
static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {