Jonathon Reinhart 97684f0970 net: Make tcp_allowed_congestion_control readonly in non-init netns ... Currently, tcp_allowed_congestion_control is global and writable; writing to it in any net namespace will leak into all other net namespaces. tcp_available_congestion_control and tcp_allowed_congestion_control are the only sysctls in ipv4_net_table (the per-netns sysctl table) with a NULL data pointer; their handlers (proc_tcp_available_congestion_control and proc_allowed_congestion_control) have no other way of referencing a struct net. Thus, they operate globally. Because ipv4_net_table does not use designated initializers, there is no easy way to fix up this one "bad" table entry. However, the data pointer updating logic shouldn't be applied to NULL pointers anyway, so we instead force these entries to be read-only. These sysctls used to exist in ipv4_table (init-net only), but they were moved to the per-net ipv4_net_table, presumably without realizing that tcp_allowed_congestion_control was writable and thus introduced a leak. Because the intent of that commit was only to know (i.e. read) "which congestion algorithms are available or allowed", this read-only solution should be sufficient. The logic added in recent commit 31c4d2f160: ("net: Ensure net namespace isolation of sysctls") does not and cannot check for NULL data pointers, because other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have .data=NULL but use other methods (.extra2) to access the struct net. Fixes: 9cb8e048e5 ("net/ipv4/sysctl: show tcp_{allowed, available}_congestion_control in non-initial netns") Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-04-13 14:42:51 -07:00
..
bpfilter	net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"	2020-08-10 12:06:44 -07:00
netfilter	netfilter: x_tables: fix compat match/target pad out-of-bound write	2021-04-13 00:18:57 +02:00
af_inet.c	net: remove cmsg restriction from io_uring based send/recvmsg calls	2021-02-23 20:32:11 -07:00
ah4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-03-03 09:32:52 +01:00
arp.c	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
bpf_tcp_ca.c	bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier	2020-12-03 17:38:21 -08:00
cipso_ipv4.c	CIPSO: Fix unaligned memory access in cipso_v4_gentag_hdr	2021-03-05 13:00:38 -08:00
datagram.c	inet: stop leaking jiffies on the wire	2019-11-01 14:57:52 -07:00
devinet.c	ipv6: report errors for iftoken via netlink extack	2021-04-08 13:52:36 -07:00
esp4_offload.c	xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets	2021-03-29 09:14:12 +02:00
esp4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-03-03 09:32:52 +01:00
fib_frontend.c	ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()	2020-12-28 14:44:32 -08:00
fib_lookup.h	IPv4: Add "offload failed" indication to routes	2021-02-08 16:47:03 -08:00
fib_notifier.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fib_rules.c	fib: use indirect call wrappers in the most common fib_rules_ops	2020-07-28 17:42:31 -07:00
fib_semantics.c	IPv4: Add "offload failed" indication to routes	2021-02-08 16:47:03 -08:00
fib_trie.c	IPv4: Extend 'fib_notify_on_flag_change' sysctl	2021-02-08 16:47:03 -08:00
fou.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
gre_demux.c	erspan: fix version 1 check in gre_parse_header()	2020-12-28 15:00:00 -08:00
gre_offload.c	ip_gre: add csum offload support for gre header	2021-01-29 20:39:14 -08:00
icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-02-23 11:29:52 -08:00
igmp.c	ip*_mc_gsfget(): lift copyout of struct group_filter into callers	2020-05-20 20:31:27 -04:00
inet_connection_sock.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-15 14:34:29 -07:00
inet_diag.c	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()	2020-11-17 16:08:36 -08:00
inet_fragment.c	inet: frags: batch fqdir destroy works	2020-12-12 15:08:54 -08:00
inet_hashtables.c	tcp: add some entropy in __inet_hash_connect()	2021-02-11 13:13:05 -08:00
inet_timewait_sock.c	net: Use generic ns_common::count	2020-08-19 14:06:36 +02:00
inetpeer.c	inetpeer: use div64_ul() and clamp_val() calculate inet_peer_threshold	2021-03-01 13:32:12 -08:00
ip_forward.c	ipv4: Revert removal of rt_uses_gateway	2019-09-20 18:23:33 -07:00
ip_fragment.c	inet: frags: re-introduce skb coalescing for local delivery	2019-08-08 15:55:10 -07:00
ip_gre.c	ipv4/ipv6: switch to dev_get_tstats64	2020-11-09 17:50:28 -08:00
ip_input.c	net: use indirect call helpers for dst_input	2021-02-03 14:51:39 -08:00
ip_options.c	net: clean up codestyle for net/ipv4	2020-08-25 06:28:02 -07:00
ip_output.c	net: use indirect call helpers for dst_output	2021-02-03 14:51:39 -08:00
ip_sockglue.c	net: Remove duplicated midx check against 0	2020-08-25 06:23:59 -07:00
ip_tunnel_core.c	net: ip_tunnel: clean up endianness conversions	2021-01-08 19:25:35 -08:00
ip_tunnel.c	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-01 13:11:35 -08:00
ip_vti.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2021-03-31 14:37:51 -07:00
ipcomp.c	ipcomp: assign if_id to child tunnel from parent tunnel	2020-07-09 12:55:37 +02:00
ipconfig.c	net: ipconfig: ic_dev can be NULL in ic_close_devs	2021-03-22 12:57:51 -07:00
ipip.c	ipv4/ipv6: switch to dev_get_tstats64	2020-11-09 17:50:28 -08:00
ipmr_base.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
ipmr.c	ipmr: Use full VIF ID in netlink cache reports	2020-09-10 12:25:51 -07:00
Kconfig	net: ipv4: remove duplicate "the the" phrase in Kconfig text	2020-08-18 16:02:16 -07:00
Makefile	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
metrics.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
netfilter.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
netlink.c
nexthop.c	nexthop: Do not flush blackhole nexthops when loopback goes down	2021-03-04 14:04:49 -08:00
ping.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
proc.c	net: proc: speedup /proc/net/netstat	2021-01-29 20:59:53 -08:00
protocol.c
raw_diag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
raw.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
route.c	net: Consolidate common blackhole dst ops	2021-03-10 12:24:18 -08:00
syncookies.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
sysctl_net_ipv4.c	net: Make tcp_allowed_congestion_control readonly in non-init netns	2021-04-13 14:42:51 -07:00
tcp_bbr.c	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate	2020-11-17 11:03:22 -08:00
tcp_bic.c	tcp: fix stretch ACK bugs in BIC	2020-03-16 18:26:54 -07:00
tcp_bpf.c	bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect	2020-11-18 00:12:34 +01:00
tcp_cdg.c
tcp_cong.c	tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control	2020-11-20 18:09:47 -08:00
tcp_cubic.c	tcp_cubic: use memset and offsetof init	2021-01-15 20:22:16 -08:00
tcp_dctcp.c
tcp_dctcp.h
tcp_diag.c	inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data	2020-02-27 18:50:19 -08:00
tcp_fastopen.c	bpf: tcp: Add bpf_skops_established()	2020-08-24 14:35:00 -07:00
tcp_highspeed.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_htcp.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: tcp_data_ready() must look at SOCK_DONE	2021-02-15 13:20:36 -08:00
tcp_ipv4.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-02-16 13:14:06 -08:00
tcp_lp.c	net: ipv4: Fix some kerneldoc warnings in TCP Low Priority	2020-10-30 12:10:57 -07:00
tcp_metrics.c	fixes-v5.11	2020-12-14 16:40:27 -08:00
tcp_minisocks.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-15 14:34:29 -07:00
tcp_nv.c
tcp_offload.c
tcp_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-28 17:09:31 -08:00
tcp_rate.c
tcp_recovery.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-01-23 21:33:01 -08:00
tcp_scalable.c	net: ipv4: delete repeated words	2020-08-24 17:31:20 -07:00
tcp_timer.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-01-23 19:32:51 -08:00
tcp_ulp.c	bpf: sockmap: Only check ULP for TCP sockets	2020-03-09 22:34:58 +01:00
tcp_vegas.c	tcp: use semicolons rather than commas to separate statements	2020-10-13 17:11:52 -07:00
tcp_vegas.h
tcp_veno.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_westwood.c
tcp_yeah.c	tcp: fix stretch ACK bugs in Yeah	2020-03-16 18:26:55 -07:00
tcp.c	tcp: add sanity tests to TCP_QUEUE_SEQ	2021-03-01 15:32:05 -08:00
tunnel4.c	tunnel4: add cb_handler to struct xfrm_tunnel	2020-07-09 12:51:36 +02:00
udp_bpf.c	net: sk_msg: Simplify sk_psock initialization	2020-08-21 15:16:11 -07:00
udp_diag.c	net: udp: remove redundant initialization in udp_dump_one	2020-11-09 16:42:49 -08:00
udp_impl.h	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
udp_offload.c	net: Fix gro aggregation for udp encaps with zero csum	2021-02-28 12:01:08 -08:00
udp_tunnel_core.c	udp_tunnel: reshuffle NETIF_F_RX_UDP_TUNNEL_PORT checks	2021-01-07 12:53:29 -08:00
udp_tunnel_nic.c	udp_tunnel: add the ability to share port tables	2020-09-28 12:50:12 -07:00
udp_tunnel_stub.c	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
udp.c	net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);	2021-04-01 15:50:50 -07:00
udplite.c	net/ipv4: remove compat_ip_{get,set}sockopt	2020-07-19 18:16:41 -07:00
xfrm4_input.c	xfrm: state: remove extract_input indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm4_output.c	xfrm: fix unused variable warning if CONFIG_NETFILTER=n	2020-05-11 15:12:27 +02:00
xfrm4_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
xfrm4_protocol.c	xfrm: add route lookup to xfrm4_rcv_encap	2019-12-09 09:59:07 +01:00
xfrm4_state.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c	xfrm: interface: fix the priorities for ipip and ipv6 tunnels	2020-10-09 12:29:48 +02:00