Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 10/27/26 12:46 PM, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
>
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
>
> Check the namespace restriction before acquiring the reference, as
> tcp_set_congestion_control() already does.
>
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> ---
> changes in v2:
>    - Check the namespace restriction before bpf_try_module_get(), following
>      tcp_set_congestion_control().
>    - Describe the module-backed reference leak and module refcount overflow.
>
>   net/ipv4/tcp_cong.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
> index 8e83ef81fc187..e3f462f161dd6 100644
> --- a/net/ipv4/tcp_cong.c
> +++ b/net/ipv4/tcp_cong.c
> @@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
>   	ca = tcp_ca_find_autoload(name);
>   	if (!ca) {
>   		ret = -ENOENT;
> -	} else if (!bpf_try_module_get(ca, ca->owner)) {
> -		ret = -EBUSY;
>   	} else if (!net_eq(net, &init_net) &&
>   			!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
>   		/* Only init netns can set default to a restricted algorithm */
>   		ret = -EPERM;
> +	} else if (!bpf_try_module_get(ca, ca->owner)) {
> +		ret = -EBUSY;
>   	} else {
>   		prev = xchg(&net->ipv4.tcp_congestion_control, ca);
>   		if (prev)