netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

kernel: unshare a network namespace without taking Task.mu

Browse Source 
t.netns is an atomic pointer so it should not be a problem for readers.
As for writers, only task can change its network namespace.

Reported-by: syzbot+8e29d377b851dcdfbca2@syzkaller.appspotmail.com
Reported-by: syzbot+9ffa998047fce0c57473@syzkaller.appspotmail.com
Reported-by: syzbot+c1c75367b97f5e31a12f@syzkaller.appspotmail.com
PiperOrigin-RevId: 542384765
This commit is contained in:
Andrei Vagin
2023-06-21 15:51:28 -07:00
committed by gVisor bot
parent a7d4a785b5
commit fedbf08401
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/kernel/task_clone.go
+2 -3
View File
@@ -466,17 +466,16 @@ func (t *Task) Unshare(flags int32) error {
}
t.childPIDNamespace = t.tg.pidns.NewChild(t.UserNamespace())
}
t.mu.Lock()
// Can't defer unlock: DecRefs must occur without holding t.mu.
var oldNETNS *inet.Namespace
if flags&linux.CLONE_NEWNET != 0 {
if !haveCapSysAdmin {
t.mu.Unlock()
return linuxerr.EPERM
}
oldNETNS = t.netns.Load()
t.netns.Store(inet.NewNamespace(t.netns.Load()))
}
t.mu.Lock()
// Can't defer unlock: DecRefs must occur without holding t.mu.
if flags&linux.CLONE_NEWUTS != 0 {
if !haveCapSysAdmin {
t.mu.Unlock()