There are some problems with network device ifindex handling in
the core and veth driver.
* Network device index (ifindex) is signed int, but only values > 0
consodered to be valid. However it is possible for userspace
to supply negative ifindex value using following command:
# ip link add dev dummy2 index -100 up type dummy
# ip link sh dev dummy2
Device "dummy2" does not exist.
# ip li sh |tail -n2
-100: dummy2: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue \
state UNKNOWN mode DEFAULT group default
link/ether 7e:77:1b:49:50:de brd ff:ff:ff:ff:ff:ff
* It is possible to hit infinite loop when number of ifindex in
some network namespace get exchausted.
# There should be plenty of RAM to create INT_MAX netdev.
# Hitting OOM is much likely with such huge number, but anyway.
for ((i = 1; i <= 0x7fffffff; i++)); do
ifname="dummy$i";
[ ! -d "/sys/class/net/$ifname" ] || continue
ip link add dev "$ifname" index "$i" type dummy
done
* (minor) check for dev->ifindex being greater than zero.
Patches in this series tries to address these problems.
Serhey Popovych (3):
dev: Prevent creating network devices with negative ifindex
dev: Avoid infinite loop on network device index exhaustion
veth: Set ifindex only if given and not negative
drivers/net/veth.c | 2 +-
net/core/dev.c | 30 ++++++++++++++++++++++--------
2 files changed, 23 insertions(+), 9 deletions(-)
--
1.8.3.1
