* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 [not found] ` <20250403144748.3399661-1-shaopeijie@cestc.cn> @ 2025-04-07 14:31 ` Christoph Hellwig 2025-04-07 17:18 ` Kuniyuki Iwashima 0 siblings, 1 reply; 6+ messages in thread From: Christoph Hellwig @ 2025-04-07 14:31 UTC (permalink / raw) To: shaopeijie Cc: kbusch, sagi, axboe, hch, linux-nvme, linux-kernel, gechangzhong, zhang.guanghui, netdev I had another look at this patch, and it feels wrong to me. I don't think we are supposed to create sockets triggered by activity in a network namespace in the global namespace even if they are indirectly created through the nvme interface. But maybe I'm misunderstanding how network namespaces work, which is entirely possible. So to avoid the failure I'd be tempted to instead revert commit 1be52169c348 until the problem is fully sorted out. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 2025-04-07 14:31 ` [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 Christoph Hellwig @ 2025-04-07 17:18 ` Kuniyuki Iwashima 2025-04-08 5:04 ` Christoph Hellwig 0 siblings, 1 reply; 6+ messages in thread From: Kuniyuki Iwashima @ 2025-04-07 17:18 UTC (permalink / raw) To: hch Cc: axboe, gechangzhong, kbusch, linux-kernel, linux-nvme, netdev, sagi, shaopeijie, zhang.guanghui, kuniyu From: Christoph Hellwig <hch@lst.de> Date: Mon, 7 Apr 2025 16:31:21 +0200 > I had another look at this patch, and it feels wrong to me. I don't > think we are supposed to create sockets triggered by activity in > a network namespace in the global namespace even if they are indirectly > created through the nvme interface. But maybe I'm misunderstanding > how network namespaces work, which is entirely possible. > > So to avoid the failure I'd be tempted to instead revert commit > 1be52169c348 until the problem is fully sorted out. The followup patch is wrong, and the correct fix is to take a reference to the netns by sk_net_refcnt_upgrade(). ---8<--- diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 26c459f0198d..72d260201d8c 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1803,6 +1803,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid, ret = PTR_ERR(sock_file); goto err_destroy_mutex; } + + sk_net_refcnt_upgrade(queue->sock->sk); nvme_tcp_reclassify_socket(queue->sock); /* Single syn retry */ ---8<--- ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 2025-04-07 17:18 ` Kuniyuki Iwashima @ 2025-04-08 5:04 ` Christoph Hellwig 2025-04-08 5:55 ` Kuniyuki Iwashima 0 siblings, 1 reply; 6+ messages in thread From: Christoph Hellwig @ 2025-04-08 5:04 UTC (permalink / raw) To: Kuniyuki Iwashima Cc: hch, axboe, gechangzhong, kbusch, linux-kernel, linux-nvme, netdev, sagi, shaopeijie, zhang.guanghui On Mon, Apr 07, 2025 at 10:18:18AM -0700, Kuniyuki Iwashima wrote: > The followup patch is wrong, and the correct fix is to take a reference > to the netns by sk_net_refcnt_upgrade(). Can you send a formal patch for this? ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 2025-04-08 5:04 ` Christoph Hellwig @ 2025-04-08 5:55 ` Kuniyuki Iwashima 2025-04-08 5:58 ` Christoph Hellwig 0 siblings, 1 reply; 6+ messages in thread From: Kuniyuki Iwashima @ 2025-04-08 5:55 UTC (permalink / raw) To: hch Cc: axboe, gechangzhong, kbusch, kuniyu, linux-kernel, linux-nvme, netdev, sagi, shaopeijie, zhang.guanghui From: Christoph Hellwig <hch@lst.de> Date: Tue, 8 Apr 2025 07:04:08 +0200 > On Mon, Apr 07, 2025 at 10:18:18AM -0700, Kuniyuki Iwashima wrote: > > The followup patch is wrong, and the correct fix is to take a reference > > to the netns by sk_net_refcnt_upgrade(). > > Can you send a formal patch for this? For sure. Which branch/tag should be based on, for-next or nvme-6.15 ? http://git.infradead.org/nvme.git ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 2025-04-08 5:55 ` Kuniyuki Iwashima @ 2025-04-08 5:58 ` Christoph Hellwig 2025-04-08 6:08 ` Kuniyuki Iwashima 0 siblings, 1 reply; 6+ messages in thread From: Christoph Hellwig @ 2025-04-08 5:58 UTC (permalink / raw) To: Kuniyuki Iwashima Cc: hch, axboe, gechangzhong, kbusch, linux-kernel, linux-nvme, netdev, sagi, shaopeijie, zhang.guanghui On Mon, Apr 07, 2025 at 10:55:27PM -0700, Kuniyuki Iwashima wrote: > Which branch/tag should be based on, for-next or nvme-6.15 ? > http://git.infradead.org/nvme.git nvme-6.15 is the canonical tree, but for bug fixes I'm fine with almost anything :) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 2025-04-08 5:58 ` Christoph Hellwig @ 2025-04-08 6:08 ` Kuniyuki Iwashima 0 siblings, 0 replies; 6+ messages in thread From: Kuniyuki Iwashima @ 2025-04-08 6:08 UTC (permalink / raw) To: hch Cc: axboe, gechangzhong, kbusch, kuniyu, linux-kernel, linux-nvme, netdev, sagi, shaopeijie, zhang.guanghui From: Christoph Hellwig <hch@lst.de> Date: Tue, 8 Apr 2025 07:58:30 +0200 > On Mon, Apr 07, 2025 at 10:55:27PM -0700, Kuniyuki Iwashima wrote: > > Which branch/tag should be based on, for-next or nvme-6.15 ? > > http://git.infradead.org/nvme.git > > nvme-6.15 is the canonical tree, but for bug fixes I'm fine with > almost anything :) Thanks, will post a patch tomorrow :) ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-04-08 6:08 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <bd5f2f8a-94f0-43b0-af02-565422d12032@cestc.cn>
[not found] ` <20250403144748.3399661-1-shaopeijie@cestc.cn>
2025-04-07 14:31 ` [PATCH v2] nvme-tcp: Fix netns UAF introduced by commit 1be52169c348 Christoph Hellwig
2025-04-07 17:18 ` Kuniyuki Iwashima
2025-04-08 5:04 ` Christoph Hellwig
2025-04-08 5:55 ` Kuniyuki Iwashima
2025-04-08 5:58 ` Christoph Hellwig
2025-04-08 6:08 ` Kuniyuki Iwashima
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).