ip6_gre: fix tunnel list corruption for x-netns

BugLink: https://bugs.launchpad.net/bugs/1812875
In changelink ops, the ip6gre_net pointer is retrieved from
dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not
unlinked from its current list and is relinked into another net
namespace. This corrupts the tunnel lists and can later trigger a kernel
oops.

Fix this by retrieving the netns from device private area.

Fixes: c8632fc30bb0 ("net: ip6_gre: Split up ip6gre_changelink()")
Cc: Petr Machata <petrm@mellanox.com>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ab5098fa25b91cb6fe0a0676f17abb64f2bbf024)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 14f66046bd72edf95ce9cf5a7d6d89279c623afc..17192f9443d5e0010a315410410c59fc105208dc 100644 (file)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1495,9 +1495,9 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct nlattr *data[],
                             struct netlink_ext_ack *extack)
 {
-       struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
+       struct ip6_tnl *t = netdev_priv(dev);
+       struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
        struct __ip6_tnl_parm p;
-       struct ip6_tnl *t;
 
        t = ip6gre_changelink_common(dev, tb, data, &p, extack);
        if (IS_ERR(t))