The host can move an ip6tnl, sit or vti6 tunnel into a container whose VE lacks the tunnel feature, or into any container for vti6. The driver frees its pernet struct in such a netns, and the dellink, changelink and ioctl handlers that look it up through dev_net(dev) dereference NULL: container root deleting or reconfiguring the tunnel, the container stop and a module unload all panic the node. "net/ip6_gre: fix a host panic deleting ip6gre moved into a CT without ipgre" fixes the same in ip6_gre.
Patches 1 and 2 take the pernet struct from t->net in ip6_tunnel and sit. Patches 3-5 backport the mainline vti6 fixes for moved tunnels, patch 6 is the vz-only rest for vti6. On stock 22.19 ip link del, ip link change and SIOCGETTUNNEL in the CT and vzctl stop panic the node on a moved tunnel. With the series they and rmmod of the modules pass, and ip6_vti0 can no longer leave the host netns. https://virtuozzo.atlassian.net/browse/VSTOR-154346 https://virtuozzo.atlassian.net/browse/VSTOR-154347 https://virtuozzo.atlassian.net/browse/VSTOR-154348 Denis V. Lunev (3): net/ip6_tunnel: fix a host panic deleting ip6tnl moved into a CT without ipip net/sit: fix a host panic deleting sit moved into a CT without sit net/ip6_vti: fix host panics on a vti6 tunnel moved into a CT Eric Dumazet (1): ms/ip6_vti: set netns_immutable on the fallback device. Kuniyuki Iwashima (1): ms/ip6: vti: Use ip6_tnl.net in vti6_changelink(). Maoyi Xie (1): ms/ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). net/ipv6/ip6_tunnel.c | 4 ++-- net/ipv6/ip6_vti.c | 29 +++++++++++++++++++---------- net/ipv6/sit.c | 4 ++-- 3 files changed, 23 insertions(+), 14 deletions(-) -- 2.53.0 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
