Re: [PATCH net 1/1] tcp: release congestion control reference on rejection

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 10/22/26 2:57 AM, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to the selected
> algorithm before checking whether a non-init netns may select a
> restricted algorithm. When the check fails, the function returns -EPERM
> without dropping the reference.
>
> For BPF struct_ops algorithms this keeps the struct_ops map and its
> programs alive. For module-backed algorithms it leaks the module
> reference as well. A network namespace administrator can repeatedly
> trigger the rejected request after the algorithm has been loaded.
>
> Drop the reference on the rejection path.
>
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>   net/ipv4/tcp_cong.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
> index 8e83ef81fc187..907c63af14785 100644
> --- a/net/ipv4/tcp_cong.c
> +++ b/net/ipv4/tcp_cong.c
> @@ -293,6 +293,7 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
>   	} else if (!net_eq(net, &init_net) &&
>   			!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
>   		/* Only init netns can set default to a restricted algorithm */
> +		bpf_module_put(ca, ca->owner);
>   		ret = -EPERM;
>   	} else {
>   		prev = xchg(&net->ipv4.tcp_congestion_control, ca);


Can we just move net_eq before bpf_try_module_get ?

Since we are not allowed to load it, I think we should aslo not touch it ?