TencentOS-kernel/net/ipv4
Jonathon Reinhart 688715a276 net: Only allow init netns to set default tcp cong to a restricted algo
commit 8d432592f30fcc34ef5a10aac4887b4897884493 upstream.

tcp_set_default_congestion_control() is netns-safe in that it writes
to &net->ipv4.tcp_congestion_control, but it also sets
ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced.
This has the unintended side-effect of changing the global
net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it
is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control
readonly in non-init netns")

Resolve this netns "leak" by only allowing the init netns to set the
default algorithm to one that is restricted. This restriction could be
removed if tcp_allowed_congestion_control were namespace-ified in the
future.

This bug was uncovered with
https://github.com/JonathonReinhart/linux-netns-sysctl-verify

Fixes: 6670e1524477 ("tcp: Namespace-ify sysctl_tcp_default_congestion_control")
Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-20 16:08:01 +08:00
..
bpfilter Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
netfilter netfilter: arp_tables: add pre_exit hook for table unregister 2021-05-20 16:07:12 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
af_inet.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ah4.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arp.c Exempt multicast addresses from five-second neighbor lifetime 2021-03-16 16:41:04 +08:00
cipso_ipv4.c cipso,calipso: resolve a number of problems with the DOI refcounts 2021-04-12 12:52:59 +08:00
datagram.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
devinet.c devinet: fix memleak in inetdev_init() 2021-03-16 16:28:49 +08:00
esp4.c esp: avoid unneeded kmap_atomic call 2021-04-12 12:51:30 +08:00
esp4_offload.c esp: delete NETIF_F_SCTP_CRC bit from features for esp offload 2021-05-20 16:06:59 +08:00
fib_frontend.c ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() 2021-04-12 12:51:08 +08:00
fib_lookup.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fib_notifier.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fib_rules.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fib_semantics.c net: Fix the arp error in some cases 2021-03-16 16:30:46 +08:00
fib_trie.c ipv4: Silence suspicious RCU usage warning 2021-03-16 16:35:46 +08:00
fou.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
gre_demux.c erspan: fix version 1 check in gre_parse_header() 2021-04-12 12:51:09 +08:00
gre_offload.c net: gre: recompute gre csum for sctp over gre tunnels 2021-03-16 16:33:10 +08:00
icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-04-12 12:52:42 +08:00
igmp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
inet_connection_sock.c tcp: relookup sock for RST+ACK packets handled by obsolete req sock 2021-04-12 12:53:28 +08:00
inet_diag.c inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() 2021-03-16 16:41:04 +08:00
inet_fragment.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
inet_hashtables.c net: initialize fastreuse on inet_inherit_port 2021-03-16 16:33:50 +08:00
inet_timewait_sock.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
inetpeer.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_forward.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_fragment.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_gre.c ip_gre: set dev->hard_header_len and dev->needed_headroom properly 2021-03-16 16:39:16 +08:00
ip_input.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_options.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_output.c net: ip: always refragment ip defragmented packets 2021-04-12 12:51:16 +08:00
ip_sockglue.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_tunnel.c net: ip_tunnel: fix mtu calculation 2021-04-12 12:51:58 +08:00
ip_tunnel_core.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ip_vti.c ip_vti: receive ipip packet by calling ip_tunnel_rcv 2021-03-16 16:28:39 +08:00
ipcomp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ipconfig.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ipip.c net: ipip: fix wrong address family in init error path 2021-03-16 16:28:23 +08:00
ipmr.c net: don't return invalid table id error when we fall back to PF_UNSPEC 2021-03-16 16:28:22 +08:00
ipmr_base.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
metrics.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
netfilter.c netfilter: use actual socket sk rather than skb sk when routing harder 2021-03-16 16:40:35 +08:00
netlink.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nexthop.c nexthop: Do not flush blackhole nexthops when loopback goes down 2021-04-12 12:52:58 +08:00
ping.c ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg 2021-03-16 16:31:42 +08:00
proc.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
protocol.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
raw.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
raw_diag.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
route.c inet: use bigger hash table for IP ID generation 2021-05-20 16:07:55 +08:00
syncookies.c net: Update window_clamp if SOCK_RCVBUF is set 2021-03-16 16:40:58 +08:00
sysctl_net_ipv4.c net: change TCP_TIMEWAIT_LEN on runtime 2021-03-16 16:43:58 +08:00
tcp.c tcp: add sanity tests to TCP_QUEUE_SEQ 2021-04-12 12:52:57 +08:00
tcp_bbr.c tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate 2021-03-16 16:41:08 +08:00
tcp_bic.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_bpf.c bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect 2021-03-16 16:41:21 +08:00
tcp_cdg.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_cong.c net: Only allow init netns to set default tcp cong to a restricted algo 2021-05-20 16:08:01 +08:00
tcp_cubic.c tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT 2021-03-16 16:30:49 +08:00
tcp_dctcp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_dctcp.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_diag.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_fastopen.c tcp: correct read of TFO keys on big endian systems 2021-03-16 16:33:49 +08:00
tcp_highspeed.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_htcp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_hybla.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_illinois.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_input.c tcp: make TCP_USER_TIMEOUT accurate for zero window probes 2021-04-12 12:51:49 +08:00
tcp_ipv4.c tcp: do not mess with cloned skbs in tcp_add_backlog() 2021-04-12 12:51:40 +08:00
tcp_lp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_metrics.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_minisocks.c tcp: relookup sock for RST+ACK packets handled by obsolete req sock 2021-04-12 12:53:28 +08:00
tcp_nv.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_offload.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_output.c tcp: make TCP_USER_TIMEOUT accurate for zero window probes 2021-04-12 12:51:49 +08:00
tcp_rate.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_recovery.c tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN 2021-04-12 12:51:48 +08:00
tcp_scalable.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_timer.c tcp: make TCP_USER_TIMEOUT accurate for zero window probes 2021-04-12 12:51:49 +08:00
tcp_ulp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_vegas.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_vegas.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_veno.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_westwood.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tcp_yeah.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tunnel4.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
udp.c net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); 2021-05-20 16:07:01 +08:00
udp_diag.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
udp_impl.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
udp_offload.c net: Fix gro aggregation for udp encaps with zero csum 2021-04-12 12:52:56 +08:00
udp_tunnel.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
udplite.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfrm4_input.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfrm4_output.c xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish 2021-03-16 16:26:53 +08:00
xfrm4_policy.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfrm4_protocol.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfrm4_state.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfrm4_tunnel.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00