Re: setns() affecting other threads in 5.10.132 and 6.0

On Mon, Sep 05, 2022 at 09:54:34AM +0000, David Laight wrote:

7055197705709c59b8ab77e6a5c7d46d61edd96e
Author: Alexey Dobriyan [off-list ref]
    Cc: Al Viro [off-list ref]
    Signed-off-by: Andrew Morton [off-list ref]
c6c75deda813
1fde6f21d90f

quoted

-----Original Message-----
From: David Laight <redacted>
Sent: 04 September 2022 15:05

Sometime after 5.10.105 (5.10.132 and 6.0) there is a change that
makes setns(open("/proc/1/ns/net")) in the main process change
the behaviour of other process threads.

Not again...

quoted

I don't know how much is broken, but the following fails.

Create a network namespace (eg "test").
Create a 'bond' interface (eg "test0") in the namespace.

Then /proc/net/bonding/test0 only exists inside the namespace.

However if you run a program in the "test" namespace that does:
- create a thread.
- change the main thread to in "init" namespace.
- try to open /proc/net/bonding/test0 in the thread.
then the open fails.

I don't know how much else is affected and haven't tried
to bisect (I can't create bonds on my normal test kernel).

I've now bisected it.
Prior to change 7055197705709c59b8ab77e6a5c7d46d61edd96e
    proc: fix dentry/inode overinstantiating under /proc/${pid}/net
the setns() had no effect of either thread.
Afterwards both threads see the entries in the init namespace.

However I think that in 5.10.105 the setns() did affect
the thread it was run in.
That might be the behaviour before c6c75deda813.
    proc: fix lookup in /proc/net subdirectories after setns(2)

There is also the earlier 1fde6f21d90f
    proc: fix /proc/net/* after setns(2)

From the commit messages it does look as though setns() should
change what is seen, but just for the current thread.
So it is currently broken - and has been since 5.18.0-rc4
and whichever stable branches the change was backported to.

	David

quoted

The test program below shows the problem.
Compile and run as:
# ip netns exec test strace -f test_prog /proc/net/bonding/test0

The second open by the child should succeed, but fails.

I can't see any changes to the bonding code, so I suspect
it is something much more fundamental.
It might only affect /proc/net, but it might also affect
which namespace sockets get created in.

How? setns(2) acts on "current", and sockets are created from
current->nsproxy->net_ns?

quoted

IIRC ls -l /proc/n/task/*/ns gives the correct namespaces.

quoted

	David


#define _GNU_SOURCE

#include <fcntl.h>
#include <unistd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>

#define delay(secs) poll(0,0, (secs) * 1000)

static void *thread_fn(void *file)
{
        delay(2);
        open(file, O_RDONLY);

        delay(5);
        open(file, O_RDONLY);

        return NULL;
}

int main(int argc, char **argv)
{
        pthread_t id;

        pthread_create(&id, NULL, thread_fn, argv[1]);

        delay(1);
        open(argv[1], O_RDONLY);

        delay(2);
        setns(open("/proc/1/ns/net", O_RDONLY), 0);

        delay(1);
        open(argv[1], O_RDONLY);

        delay(4);

        return 0;
}

Can you test before this one? This is where it all started.

	commit 1da4d377f943fe4194ffb9fb9c26cc58fad4dd24
	Author: Alexey Dobriyan [off-list ref]
	Date:   Fri Apr 13 15:35:42 2018 -0700

	    proc: revalidate misc dentries