[PATCH net] ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

[PATCH net] ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

[Eric Dumazet]

ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
too soon.

Only after unregister_net_sysctl_table() we can be sure no threads can possibly
use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.

Fixes: 122ff243f5f1 ("ipv4: make ip_local_reserved_ports per netns")
Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/ipv4/sysctl_net_ipv4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index d8bdb1bdbff17ab52fe969b93ce13673e88c05a4..c0e85cc171aec099fd5d4897b1a623dd27eaee08 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -1705,10 +1705,10 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
 {
 	const struct ctl_table *table;
 
-	kfree(net->ipv4.sysctl_local_reserved_ports);
 	table = net->ipv4.ipv4_hdr->ctl_table_arg;
 	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
 	kfree(table);
+	kfree(net->ipv4.sysctl_local_reserved_ports);
 }
 
 static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
-- 
2.54.0.669.g59709faab0-goog

Re: [PATCH net] ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

[Jason Xing]

On Thu, May 21, 2026 at 8:30 PM Eric Dumazet <edumazet@google.com> wrote:
>
> ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
> too soon.
>
> Only after unregister_net_sysctl_table() we can be sure no threads can possibly
> use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
>
> Fixes: 122ff243f5f1 ("ipv4: make ip_local_reserved_ports per netns")
> Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>

Thanks!

Re: [PATCH net] ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

[Jiayuan Chen]

On 5/21/26 8:21 PM, Eric Dumazet wrote:
> ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
> too soon.
>
> Only after unregister_net_sysctl_table() we can be sure no threads can possibly
> use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
>
> Fixes: 122ff243f5f1 ("ipv4: make ip_local_reserved_ports per netns")
> Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   net/ipv4/sysctl_net_ipv4.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index d8bdb1bdbff17ab52fe969b93ce13673e88c05a4..c0e85cc171aec099fd5d4897b1a623dd27eaee08 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -1705,10 +1705,10 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
>   {
>   	const struct ctl_table *table;
>   
> -	kfree(net->ipv4.sysctl_local_reserved_ports);
>   	table = net->ipv4.ipv4_hdr->ctl_table_arg;
>   	unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
>   	kfree(table);
> +	kfree(net->ipv4.sysctl_local_reserved_ports);
>   }
>   
>   static __net_initdata struct pernet_operations ipv4_sysctl_ops = {


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


If there are still processes in the namespace, the netns refcnt cannot 
become 0,

so I think it should be: first open 
/proc/sys/net/ipv4/ip_local_reserved_ports, then pass

the fd to another process outside the netns? Maybe SCM_RIGHTS is used?

Re: [PATCH net] ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

[Eric Dumazet]

On Thu, May 21, 2026 at 6:59 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
>
> On 5/21/26 8:21 PM, Eric Dumazet wrote:
> > ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
> > too soon.
> >
> > Only after unregister_net_sysctl_table() we can be sure no threads can possibly
> > use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
> >
> > Fixes: 122ff243f5f1 ("ipv4: make ip_local_reserved_ports per netns")
> > Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Cong Wang <xiyou.wangcong@gmail.com>
> > ---
> >   net/ipv4/sysctl_net_ipv4.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> > index d8bdb1bdbff17ab52fe969b93ce13673e88c05a4..c0e85cc171aec099fd5d4897b1a623dd27eaee08 100644
> > --- a/net/ipv4/sysctl_net_ipv4.c
> > +++ b/net/ipv4/sysctl_net_ipv4.c
> > @@ -1705,10 +1705,10 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
> >   {
> >       const struct ctl_table *table;
> >
> > -     kfree(net->ipv4.sysctl_local_reserved_ports);
> >       table = net->ipv4.ipv4_hdr->ctl_table_arg;
> >       unregister_net_sysctl_table(net->ipv4.ipv4_hdr);
> >       kfree(table);
> > +     kfree(net->ipv4.sysctl_local_reserved_ports);
> >   }
> >
> >   static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
>
>
> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>
>
> If there are still processes in the namespace, the netns refcnt cannot
> become 0,
>
> so I think it should be: first open
> /proc/sys/net/ipv4/ip_local_reserved_ports, then pass
>
> the fd to another process outside the netns? Maybe SCM_RIGHTS is used?

We will not share the repro publicly, for obvious reasons :)