From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793214071; b=CmMAmPqS34rcRv8rAP/HQgdah+dvDUVuCU/x2jLnyOWcl7RRhzWvqpho4muOR4/7Wegx 0hwI4YCxd81UJc1ZKU1e3wdL3PJIV6U8J5WXe2D/a3bxYDFGFbuz8ti46biPtc3H6mtfH bEW15+bOgC+NVsBqYOUvd1QALsf5KwBRsLF3LPckSiU8LaiJFW7Lu3MNnTj5BUVFQqOxR iVwT1gjI1jHxW9fx9uWtOj0l8TUYuBnXAdhtu2+O7TVl6g7JBeIBnSFP7pNKqHcuS/eYv 6JfUYxYQtBfVxeJh9ru9v9aZrHnhD5AQIpZDmOQ4tlgV4NdHnfEqDhxhAsOW/haPKsQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793214071; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=wcalqMTmjZpx1dWIqIGipcN6tPih7fb0Yowp1MkndH8=; b=BgU5Ovpo6Ai/3zib4KzKMo7dSYjHLFuD2ed1IYOPwOmgfW+/FW87rmsAHBANOD4jGIOm PIM/ELC30WkkR2ETwszE5gD/1j4uF8hTbCA8I4aNYORXGGG7X0lBHfibwJznQm+020EMT YZmKRg0CEd/4P7rO9fCwh+G41ZKKhPDsFMd3qiOG3IzPoaZzSI06exEXwFJZ56kOpewy/ ze3eD+qVLnUNLZKMerD8c8ADhtphLlOxx6OQTF93CQBjriBz8xxbbHic3NPERIUjdDqfv 8dVlZ/pNOovakl6D8px8X+4zlAnAX8k2n60+XYZv7V8j7MRZvdEuJAB/sco2XQNPFCg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="bdeqTSQ/"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19A1F606A334; Wed, 28 Oct 2026 19:01:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bdeqTSQ/ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B1431F01825; Wed, 28 Oct 2026 19:01:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793214071; bh=wcalqMTmjZpx1dWIqIGipcN6tPih7fb0Yowp1MkndH8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bdeqTSQ/GXWpDd1OKa4P3JsC8FQipRUAAPkrBn+QKgeBIL832fjO5Wo1CpD4IhCgk t32+Tt6dc9eGbXcTeHuE7pKg16M4uCv6U1p830KV5G/Cr3aCneIKJCYRsiQpolObqV yZa07k4qvBHpR2klem3eSFxJMNAkOKb48j6uuM3o= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Al Viro , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.1 0730/1887] rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy Date: Wed, 28 Oct 2026 17:47:06 +0100 Message-ID: <20261028170516.062130220@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthieu Baerts (NGI0) [ Upstream commit 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c ] As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available). Fixes: c6a58ffed536 ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1] Suggested-by: Al Viro Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-9-5df34b2083e8@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/rds/tcp.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/net/rds/tcp.c b/net/rds/tcp.c index ef7cf0a6cb134..020baff6ad514 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -53,8 +53,10 @@ static atomic_t rds_tcp_unloading = ATOMIC_INIT(0); static struct kmem_cache *rds_tcp_conn_slab; -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, - void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos); static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF; static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF; @@ -66,7 +68,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_sndbuf_handler, .extra1 = &rds_tcp_min_sndbuf, }, #define RDS_TCP_RCVBUF 1 @@ -75,7 +77,7 @@ static struct ctl_table rds_tcp_sysctl_table[] = { /* data is per-net pointer */ .maxlen = sizeof(int), .mode = 0644, - .proc_handler = rds_tcp_skbuf_handler, + .proc_handler = rds_tcp_rcvbuf_handler, .extra1 = &rds_tcp_min_rcvbuf, }, { } @@ -752,10 +754,10 @@ static void rds_tcp_sysctl_reset(struct net *net) spin_unlock_irq(&rds_tcp_conn_lock); } -static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, +static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn, + struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *fpos) { - struct net *net = current->nsproxy->net_ns; int err; err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos); @@ -764,11 +766,34 @@ static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write, *(int *)(ctl->extra1)); return err; } - if (write) + + if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) { + struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk); + rds_tcp_sysctl_reset(net); + } + return 0; } +static int rds_tcp_sndbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + sndbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + +static int rds_tcp_rcvbuf_handler(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *fpos) +{ + struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net, + rcvbuf_size); + + return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos); +} + static void rds_tcp_exit(void) { rds_tcp_set_unloading(); -- 2.53.0