Jonathon Reinhart 35d7491e2f net: Make tcp_allowed_congestion_control readonly in non-init netns ... commit 97684f0970 upstream. Currently, tcp_allowed_congestion_control is global and writable; writing to it in any net namespace will leak into all other net namespaces. tcp_available_congestion_control and tcp_allowed_congestion_control are the only sysctls in ipv4_net_table (the per-netns sysctl table) with a NULL data pointer; their handlers (proc_tcp_available_congestion_control and proc_allowed_congestion_control) have no other way of referencing a struct net. Thus, they operate globally. Because ipv4_net_table does not use designated initializers, there is no easy way to fix up this one "bad" table entry. However, the data pointer updating logic shouldn't be applied to NULL pointers anyway, so we instead force these entries to be read-only. These sysctls used to exist in ipv4_table (init-net only), but they were moved to the per-net ipv4_net_table, presumably without realizing that tcp_allowed_congestion_control was writable and thus introduced a leak. Because the intent of that commit was only to know (i.e. read) "which congestion algorithms are available or allowed", this read-only solution should be sufficient. The logic added in recent commit 31c4d2f160: ("net: Ensure net namespace isolation of sysctls") does not and cannot check for NULL data pointers, because other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have .data=NULL but use other methods (.extra2) to access the struct net. Fixes: 9cb8e048e5 ("net/ipv4/sysctl: show tcp_{allowed, available}_congestion_control in non-initial netns") Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-21 13:00:57 +02:00
..
bpfilter	net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"	2020-08-10 12:06:44 -07:00
netfilter	netfilter: arp_tables: add pre_exit hook for table unregister	2021-04-21 13:00:56 +02:00
af_inet.c	io_uring: allow tcp ancillary data for __sys_recvmsg_sock()	2020-08-24 16:16:06 -07:00
ah4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-04-14 08:42:05 +02:00
arp.c	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
bpf_tcp_ca.c	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
cipso_ipv4.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
datagram.c	inet: stop leaking jiffies on the wire	2019-11-01 14:57:52 -07:00
devinet.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-05-31 17:48:46 -07:00
esp4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-04-14 08:42:05 +02:00
esp4_offload.c	xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets	2021-04-14 08:42:07 +02:00
fib_frontend.c	ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()	2021-01-12 20:18:12 +01:00
fib_lookup.h	net: add net available in build_state	2020-03-29 22:30:57 -07:00
fib_notifier.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fib_rules.c	fib: use indirect call wrappers in the most common fib_rules_ops	2020-07-28 17:42:31 -07:00
fib_semantics.c	net: Fix the arp error in some cases	2020-06-18 20:21:51 -07:00
fib_trie.c	ipv4: Silence suspicious RCU usage warning	2020-08-26 15:58:48 -07:00
fou.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
gre_demux.c	erspan: fix version 1 check in gre_parse_header()	2021-01-12 20:18:12 +01:00
gre_offload.c	net: gre: recompute gre csum for sctp over gre tunnels	2020-08-03 15:29:44 -07:00
icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
igmp.c	ip*_mc_gsfget(): lift copyout of struct group_filter into callers	2020-05-20 20:31:27 -04:00
inet_connection_sock.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-30 14:31:59 +02:00
inet_diag.c	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()	2020-11-17 16:08:36 -08:00
inet_fragment.c
inet_hashtables.c	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
inet_timewait_sock.c
inetpeer.c	inetpeer: fix data-race in inet_putpeer / inet_putpeer	2019-11-07 16:15:56 -08:00
ip_forward.c
ip_fragment.c
ip_gre.c	ip_gre: set dev->hard_header_len and dev->needed_headroom properly	2020-10-13 18:35:29 -07:00
ip_input.c	bpf: Add socket assign support	2020-03-30 13:45:04 -07:00
ip_options.c	net: clean up codestyle for net/ipv4	2020-08-25 06:28:02 -07:00
ip_output.c	net: ip: always refragment ip defragmented packets	2021-01-17 14:16:56 +01:00
ip_sockglue.c	net: Remove duplicated midx check against 0	2020-08-25 06:23:59 -07:00
ip_tunnel.c	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-17 17:06:12 +01:00
ip_tunnel_core.c	tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies	2020-11-09 15:39:39 -08:00
ip_vti.c	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-17 17:06:12 +01:00
ipcomp.c	ipcomp: assign if_id to child tunnel from parent tunnel	2020-07-09 12:55:37 +02:00
ipconfig.c	net: ipconfig: Avoid spurious blank lines in boot log	2020-12-26 16:02:38 +01:00
ipip.c	net: ipip: implement header_ops->parse_protocol for AF_PACKET	2020-06-30 12:29:39 -07:00
ipmr.c	ipmr: Use full VIF ID in netlink cache reports	2020-09-10 12:25:51 -07:00
ipmr_base.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
Kconfig	net: ipv4: remove duplicate "the the" phrase in Kconfig text	2020-08-18 16:02:16 -07:00
Makefile	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
metrics.c
netfilter.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
netlink.c
nexthop.c	nexthop: Do not flush blackhole nexthops when loopback goes down	2021-03-17 17:06:14 +01:00
ping.c	net: clean up codestyle	2020-08-31 12:33:34 -07:00
proc.c	tcp: skip DSACKs with dubious sequence ranges	2020-09-24 20:15:45 -07:00
protocol.c
raw.c	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
raw_diag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
route.c	net: Consolidate common blackhole dst ops	2021-03-30 14:32:05 +02:00
syncookies.c	net: Update window_clamp if SOCK_RCVBUF is set	2020-11-10 17:42:35 -08:00
sysctl_net_ipv4.c	net: Make tcp_allowed_congestion_control readonly in non-init netns	2021-04-21 13:00:57 +02:00
tcp.c	tcp: add sanity tests to TCP_QUEUE_SEQ	2021-03-17 17:06:11 +01:00
tcp_bbr.c	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate	2020-11-17 11:03:22 -08:00
tcp_bic.c	tcp: fix stretch ACK bugs in BIC	2020-03-16 18:26:54 -07:00
tcp_bpf.c	bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect	2020-11-18 00:12:34 +01:00
tcp_cdg.c
tcp_cong.c	tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control	2020-11-20 18:09:47 -08:00
tcp_cubic.c	tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT	2020-06-25 16:08:47 -07:00
tcp_dctcp.c
tcp_dctcp.h
tcp_diag.c	inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data	2020-02-27 18:50:19 -08:00
tcp_fastopen.c	bpf: tcp: Add bpf_skops_established()	2020-08-24 14:35:00 -07:00
tcp_highspeed.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_htcp.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-02-03 23:28:52 +01:00
tcp_ipv4.c	tcp: Fix potential use-after-free due to double kfree()	2021-01-27 11:55:28 +01:00
tcp_lp.c
tcp_metrics.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
tcp_minisocks.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-30 14:31:59 +02:00
tcp_nv.c
tcp_offload.c
tcp_output.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-02-03 23:28:51 +01:00
tcp_rate.c
tcp_recovery.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-02-03 23:28:52 +01:00
tcp_scalable.c	net: ipv4: delete repeated words	2020-08-24 17:31:20 -07:00
tcp_timer.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-02-03 23:28:51 +01:00
tcp_ulp.c	bpf: sockmap: Only check ULP for TCP sockets	2020-03-09 22:34:58 +01:00
tcp_vegas.c	tcp: use semicolons rather than commas to separate statements	2020-10-13 17:11:52 -07:00
tcp_vegas.h
tcp_veno.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_westwood.c
tcp_yeah.c	tcp: fix stretch ACK bugs in Yeah	2020-03-16 18:26:55 -07:00
tunnel4.c	tunnel4: add cb_handler to struct xfrm_tunnel	2020-07-09 12:51:36 +02:00
udp.c	net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);	2021-04-14 08:42:09 +02:00
udp_bpf.c	net: sk_msg: Simplify sk_psock initialization	2020-08-21 15:16:11 -07:00
udp_diag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
udp_impl.h	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
udp_offload.c	net: Fix gro aggregation for udp encaps with zero csum	2021-03-17 17:06:11 +01:00
udp_tunnel_core.c	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
udp_tunnel_nic.c	udp_tunnel: add the ability to share port tables	2020-09-28 12:50:12 -07:00
udp_tunnel_stub.c	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
udplite.c	net/ipv4: remove compat_ip_{get,set}sockopt	2020-07-19 18:16:41 -07:00
xfrm4_input.c	xfrm: state: remove extract_input indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm4_output.c	xfrm: fix unused variable warning if CONFIG_NETFILTER=n	2020-05-11 15:12:27 +02:00
xfrm4_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
xfrm4_protocol.c	xfrm: add route lookup to xfrm4_rcv_encap	2019-12-09 09:59:07 +01:00
xfrm4_state.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c	xfrm: interface: fix the priorities for ipip and ipv6 tunnels	2020-10-09 12:29:48 +02:00