* [PATCH net 1/1] tcp: Require init_net CAP_NET_ADMIN for tcp_child_ehash_entries
[not found] <cover.1782641525.git.roxy520tt@gmail.com>
@ 2026-06-28 11:37 ` Ren Wei
0 siblings, 0 replies; only message in thread
From: Ren Wei @ 2026-06-28 11:37 UTC (permalink / raw)
To: netdev
Cc: davem, edumazet, pabeni, horms, chia-yu.chang, ij, idosch,
fmancera, bronzed_45_vested, yuuchihsu, kuniyu, yuantan098,
yifanwucs, tomapufckgml, bird, roxy520tt, n05ec
From: Zhiling Zou <roxy520tt@gmail.com>
tcp_child_ehash_entries controls the size of the private TCP established
hash table allocated for subsequently created child network namespaces.
The value is consumed during child netns creation by tcp_set_hashinfo()
and passed to inet_pernet_hashinfo_alloc(), which can allocate a large
per-netns ehash.
The sysctl is writable in each network namespace, and net sysctl
permissions allow a task with CAP_NET_ADMIN in the namespace's owning
user namespace to write it. An unprivileged user can therefore create a
user and network namespace, set tcp_child_ehash_entries to its maximum
value, and repeatedly create nested network namespaces to force large
kernel allocations and exhaust host memory.
Require CAP_NET_ADMIN in the initial user namespace before accepting
writes to tcp_child_ehash_entries. This keeps the tuning knob available
to the host administrator while preventing unprivileged user namespaces
from using it to drive host-wide memory consumption.
Fixes: d1e5e6408b30 ("tcp: Introduce optional per-netns ehash.")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
net/ipv4/sysctl_net_ipv4.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index ca1180dba1de..1cad1b5cb826 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -9,6 +9,7 @@
#include <linux/sysctl.h>
#include <linux/seqlock.h>
#include <linux/init.h>
+#include <linux/capability.h>
#include <linux/slab.h>
#include <net/icmp.h>
#include <net/ip.h>
@@ -415,6 +416,16 @@ static int proc_tcp_ehash_entries(const struct ctl_table *table, int write,
return proc_dointvec(&tbl, write, buffer, lenp, ppos);
}
+static int proc_tcp_child_ehash_entries(const struct ctl_table *table, int write,
+ void *buffer, size_t *lenp,
+ loff_t *ppos)
+{
+ if (write && !capable(CAP_NET_ADMIN))
+ return -EPERM;
+
+ return proc_douintvec_minmax(table, write, buffer, lenp, ppos);
+}
+
static int proc_udp_hash_entries(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
@@ -1524,7 +1535,7 @@ static struct ctl_table ipv4_net_table[] = {
.data = &init_net.ipv4.sysctl_tcp_child_ehash_entries,
.maxlen = sizeof(unsigned int),
.mode = 0644,
- .proc_handler = proc_douintvec_minmax,
+ .proc_handler = proc_tcp_child_ehash_entries,
.extra1 = SYSCTL_ZERO,
.extra2 = &tcp_child_ehash_entries_max,
},
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread