Conversation
This was referenced Sep 2, 2026
The vlan_aliases kvlist is initialised lazily in device_vlan_update(), which only runs during configuration load. A bridge that is created and freed without going through a config load (e.g. one created at runtime over ubus) reaches bridge_free() with the kvlist still zero-filled, and kvlist_free() then walks an uninitialised avl_tree whose list head contains NULL pointers, crashing netifd. Guard the call on get_len, the same marker device_vlan_update() uses to tell an initialised kvlist apart. Fixes: 4544f02 ("bridge-vlan: add support for defining aliases for vlan ids") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
system_link_netns_move() built its RTM_NEWLINK message with whatever system_if_resolve() returned for the source device. When the device does not exist (e.g. a jailed interface whose veth has not been created yet), system_if_resolve() returns 0, and the message goes out with ifi_index = 0 while IFLA_IFNAME is set to target_ifname (the jail_device name). The kernel's __rtnl_newlink() then selects the target device by name when ifi_index is 0 (net/core/rtnetlink.c: rtnl_dev_get -> __dev_get_by_name), so the move operates on whatever host device happens to be named like the jail_device. With a jail_device of "eth0" this moves the host's real eth0 into the container's network namespace, knocking the host off the network. Bail out when the source device cannot be resolved to a real ifindex so the request is never sent with a zero index. Fixes: d93126d ("interface: allow renaming interface when moving to jail netns") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
interface_start_jail() moved each jailed interface's main device into the container netns at the moment the jail's netns was registered. If the device did not exist yet (e.g. a veth whose creation had not been triggered), the move was a no-op and the container came up with no network device; the in-jail netifd then failed DHCP with "udhcpc: SIOCGIFINDEX: No such device" until the operator manually brought the host interface up. Keep a duplicated reference to the jail netns on the interface when the move cannot be performed yet, and complete it from interface_main_dev_cb once the device appears (DEV_EVENT_ADD). Any stale pending reference from an earlier jail incarnation is dropped on the next interface_start_jail() invocation, so a successful immediate move can never leave a dangling netns reference behind that would later divert the device into a dead namespace. interface_stop_jail and interface_free drop any still-pending reference as well. Fixes: 1321c1b ("add basic support for jail network namespaces") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
dangowrt
force-pushed
the
netifd-procd-data
branch
from
September 11, 2026 13:21
792d4c4 to
a9879bd
Compare
dangowrt
changed the title
dangowrt
force-pushed
the
netifd-procd-data
branch
from
September 11, 2026 15:10
a9879bd to
647858c
Compare
Bridge membership could only be declared from the bridge side, so a
device published as procd network-device data could not join a bridge
it does not own. Add bridge and bridge_vlan device attributes, stored
on struct device and parsed for every device through the existing
device_attr_list, and have bridge_config_init() add every device whose
bridge attribute names this bridge as a member. When the bridge is
vlan_filtering, each member's bridge_vlan entries ("<vid>[:t][:*]") are
registered as hotplug vlan ports. bridge_vlan is ignored on a bridge
that is not vlan_filtering, so a device attribute never turns a plain
bridge into a filtering one and existing members keep their default
vlan.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
dangowrt
force-pushed
the
netifd-procd-data
branch
from
September 15, 2026 15:50
647858c to
ce6f5d2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix and improve netifd for use with procd/ujail managed containers:
vlan_aliaseskvlist uninitialised, sobridge_free()dereferences it.RTM_NEWLINKwithifi_index = 0, so the kernel matched by name and could move the host's realeth0into a container.option bridgeandlist bridge_vlanonconfig device, parsed identically from/etc/config/networkand from a procdnetwork-deviceentry, so a container manager can attach a port to a bridge it does not own without replacing it. Keeping the UCI and procd structures identical is the point of the design.bridgenames the bridge to join; eachbridge_vlannames a VLAN on it in the same<vid>[:t][:*]syntax asbridge-vlanports. The port is folded into the bridge's members from whichever source the bridge is defined (UCI device, legacyoption type bridge, or procd bridge) and dropped on the first reload after the declaration goes away;option bridgealone adds a plain member.Enabling
vlan_filteringmakesbridge_enable_member()drop the default VLAN from every member and keep only assigned ones, so a port-sidebridge_vlanon a bridge that has nobridge-vlansection of its own but already has plain members is refused rather than silently cutting those members off. procd'sujail/uxc-netis the consumer; netifd keeps no dependency on procd and ignores the options when unset.