[Devel] [PATCH RHEL7 COMMIT] net: Fix possible race in peernet2id_alloc()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1127.8.2.vz7.161.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.8.2.vz7.161.3
------>
commit 38fda25fa453f7f0476ec88c217d087c2e09a76c
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Wed May 27 21:34:52 2020 +0300

    net: Fix possible race in peernet2id_alloc()
    
    ms commit 0c06bea919f3
    
    peernet2id_alloc() is racy without rtnl_lock() as refcount_read(&peer->count)
    under net->nsid_lock does not guarantee, peer is alive:
    
    rcu_read_lock()
    peernet2id_alloc()                            ..
      spin_lock_bh(&net->nsid_lock)               ..
      refcount_read(&peer->count) (!= 0)          ..
      ..                                          put_net()
      ..                                            cleanup_net()
      ..                                              for_each_net(tmp)
      ..                                                spin_lock_bh(&tmp->nsid_lock)
      ..                                                __peernet2id(tmp, net) == -1
      ..                                                    ..
      ..                                                    ..
        __peernet2id_alloc(alloc == true)                   ..
      ..                                                    ..
    rcu_read_unlock()                                       ..
    ..                                                synchronize_rcu()
    ..                                                kmem_cache_free(net)
    
    After the above situation, net::netns_id contains id pointing to freed memory,
    and any other dereferencing by the id will operate with this freed memory.
    
    Currently, peernet2id_alloc() is used under rtnl_lock() everywhere except
    ovs_vport_cmd_fill_info(), and this race can't occur. But peernet2id_alloc()
    is generic interface, and better we fix it before someone really starts
    use it in wrong context.
    
    v2: Don't place refcount_read(&net->count) under net->nsid_lock
        as suggested by Eric W. Biederman <ebiederm at xmission.com>
    v3: Rebase on top of net-next
    
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
    
    Signed-off-by: David S. Miller <davem at davemloft.net>
    
    =====================
    Patchset description:
    
    Parallel per-net init/exit
    
    https://jira.sw.ru/browse/PSBM-104158
---
 net/core/net_namespace.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index ba2c8077eb883..b550d025e0d4a 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -224,16 +224,25 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id);
  */
 int peernet2id_alloc(struct net *net, struct net *peer)
 {
+	bool alloc = false, alive = false;
 	unsigned long flags;
-	bool alloc;
 	int id;
 
 	spin_lock_irqsave(&net->nsid_lock, flags);
-	alloc = atomic_read(&peer->count) == 0 ? false : true;
+	/*
+	 * When peer is obtained from RCU lists, we may race with
+	 * its cleanup. Check whether it's alive, and this guarantees
+	 * we never hash a peer back to net->netns_ids, after it has
+	 * just been idr_remove()'d from there in cleanup_net().
+	 */
+	if (maybe_get_net(peer))
+		alive = alloc = true;
 	id = __peernet2id_alloc(net, peer, &alloc);
 	spin_unlock_irqrestore(&net->nsid_lock, flags);
 	if (alloc && id >= 0)
 		rtnl_net_notifyid(net, RTM_NEWNSID, id);
+	if (alive)
+		put_net(peer);
 	return id;
 }
 EXPORT_SYMBOL_GPL(peernet2id_alloc);