[PATCH v3 net-next 0/4] inet: ping: misc changes

[PATCH v3 net-next 0/4] inet: ping: misc changes

[Eric Dumazet]

First and third patches improve security a bit.

Second patch (ping_hash removal) is a cleanup.

Fourth patch uses EXPORT_IPV6_MOD[_GPL].

Eric Dumazet (4):
  inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  inet: ping: remove ping_hash()
  inet: ping: make ping_port_rover per netns
  inet: ping: use EXPORT_IPV6_MOD[_GPL]()

 include/net/netns/ipv4.h |  1 +
 include/net/ping.h       |  1 -
 net/ipv4/ping.c          | 66 +++++++++++++++++++---------------------
 net/ipv6/ping.c          |  1 -
 4 files changed, 32 insertions(+), 37 deletions(-)

-- 
2.51.0.318.gd7df087d1a-goog

[PATCH v3 net-next 1/4] inet: ping: check sock_net() in ping_get_port() and ping_lookup()

[Eric Dumazet]

We need to check socket netns before considering them in ping_get_port().
Otherwise, one malicious netns could 'consume' all ports.

Add corresponding check in ping_lookup().

Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
---

v2: added change to ping_lookup().
v1: https://lore.kernel.org/netdev/CANn89iKF+DFQQyNJoYA2U-wf4QDPOUG2yNOd8fSu45hQ+TxJ5Q@mail.gmail.com/T/#u

 net/ipv4/ping.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index f119da68fc301be00719213ad33615b6754e6272..74a0beddfcc41d8ba17792a11a9d027c9d590bac 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
 
 int ping_get_port(struct sock *sk, unsigned short ident)
 {
+	struct net *net = sock_net(sk);
 	struct inet_sock *isk, *isk2;
 	struct hlist_head *hlist;
 	struct sock *sk2 = NULL;
@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		for (i = 0; i < (1L << 16); i++, result++) {
 			if (!result)
 				result++; /* avoid zero */
-			hlist = ping_hashslot(&ping_table, sock_net(sk),
-					    result);
+			hlist = ping_hashslot(&ping_table, net, result);
 			sk_for_each(sk2, hlist) {
+				if (!net_eq(sock_net(sk2), net))
+					continue;
 				isk2 = inet_sk(sk2);
 
 				if (isk2->inet_num == result)
@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		if (i >= (1L << 16))
 			goto fail;
 	} else {
-		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
+		hlist = ping_hashslot(&ping_table, net, ident);
 		sk_for_each(sk2, hlist) {
+			if (!net_eq(sock_net(sk2), net))
+				continue;
 			isk2 = inet_sk(sk2);
 
 			/* BUG? Why is this reuse and not reuseaddr? ping.c
@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		pr_debug("was not hashed\n");
 		sk_add_node_rcu(sk, hlist);
 		sock_set_flag(sk, SOCK_RCU_FREE);
-		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+		sock_prot_inuse_add(net, sk->sk_prot, 1);
 	}
 	spin_unlock(&ping_table.lock);
 	return 0;
@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
 	}
 
 	sk_for_each_rcu(sk, hslot) {
+		if (!net_eq(sock_net(sk), net))
+			continue;
 		isk = inet_sk(sk);
 
 		pr_debug("iterate\n");
-- 
2.51.0.318.gd7df087d1a-goog

[PATCH v3 net-next 2/4] inet: ping: remove ping_hash()

[Eric Dumazet]

There is no point in keeping ping_hash().

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
---
v3: Yue Haibing feedback (remove ping_hash() declaration in include/net/ping.h)
v2: https://lore.kernel.org/netdev/20250828164149.3304323-1-edumazet@google.com/T/#md0f7cce22b5a0ce71c366b75be20db3a528e8e03

 include/net/ping.h |  1 -
 net/ipv4/ping.c    | 10 ----------
 net/ipv6/ping.c    |  1 -
 3 files changed, 12 deletions(-)

diff --git a/include/net/ping.h b/include/net/ping.h
index bc7779262e60350e2748c74731a5d6d71f1b9455..9634b8800814dae4568e86fdf917bbe41d429b4b 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -54,7 +54,6 @@ struct pingfakehdr {
 };
 
 int  ping_get_port(struct sock *sk, unsigned short ident);
-int ping_hash(struct sock *sk);
 void ping_unhash(struct sock *sk);
 
 int  ping_init_sock(struct sock *sk);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 74a0beddfcc41d8ba17792a11a9d027c9d590bac..75e1b0f5c697653e79166fde5f312f46b471344a 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -67,7 +67,6 @@ static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
 	pr_debug("hash(%u) = %u\n", num, res);
 	return res;
 }
-EXPORT_SYMBOL_GPL(ping_hash);
 
 static inline struct hlist_head *ping_hashslot(struct ping_table *table,
 					       struct net *net, unsigned int num)
@@ -144,14 +143,6 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 }
 EXPORT_SYMBOL_GPL(ping_get_port);
 
-int ping_hash(struct sock *sk)
-{
-	pr_debug("ping_hash(sk->port=%u)\n", inet_sk(sk)->inet_num);
-	BUG(); /* "Please do not press this button again." */
-
-	return 0;
-}
-
 void ping_unhash(struct sock *sk)
 {
 	struct inet_sock *isk = inet_sk(sk);
@@ -1008,7 +999,6 @@ struct proto ping_prot = {
 	.bind =		ping_bind,
 	.backlog_rcv =	ping_queue_rcv_skb,
 	.release_cb =	ip4_datagram_release_cb,
-	.hash =		ping_hash,
 	.unhash =	ping_unhash,
 	.get_port =	ping_get_port,
 	.put_port =	ping_unhash,
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 82b0492923d458213ac7a6f9316158af2191e30f..d7a2cdaa26312b44f1fe502d3d40f3e27f961fa8 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -208,7 +208,6 @@ struct proto pingv6_prot = {
 	.recvmsg =	ping_recvmsg,
 	.bind =		ping_bind,
 	.backlog_rcv =	ping_queue_rcv_skb,
-	.hash =		ping_hash,
 	.unhash =	ping_unhash,
 	.get_port =	ping_get_port,
 	.put_port =	ping_unhash,
-- 
2.51.0.318.gd7df087d1a-goog

[PATCH v3 net-next 3/4] inet: ping: make ping_port_rover per netns

[Eric Dumazet]

Provide isolation between netns for ping idents.

Randomize initial ping_port_rover value at netns creation.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
---
 include/net/netns/ipv4.h |  1 +
 net/ipv4/ping.c          | 10 +++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 6373e3f17da84ebc5c11058763932e595f0fd205..54a7d187f62a2e995076e85f1e6b2fd70f84b2c1 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -251,6 +251,7 @@ struct netns_ipv4 {
 	int sysctl_igmp_qrv;
 
 	struct ping_group_range ping_group_range;
+	u16			ping_port_rover;
 
 	atomic_t dev_addr_genid;
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 75e1b0f5c697653e79166fde5f312f46b471344a..98ccd4f9ed657d2bb9c013932d0c678f2b38a746 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -58,8 +58,6 @@ static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
 
-static u16 ping_port_rover;
-
 static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
 {
 	u32 res = (num + net_hash_mix(net)) & mask;
@@ -84,12 +82,12 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 	isk = inet_sk(sk);
 	spin_lock(&ping_table.lock);
 	if (ident == 0) {
+		u16 result = net->ipv4.ping_port_rover + 1;
 		u32 i;
-		u16 result = ping_port_rover + 1;
 
 		for (i = 0; i < (1L << 16); i++, result++) {
 			if (!result)
-				result++; /* avoid zero */
+				continue; /* avoid zero */
 			hlist = ping_hashslot(&ping_table, net, result);
 			sk_for_each(sk2, hlist) {
 				if (!net_eq(sock_net(sk2), net))
@@ -101,7 +99,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 			}
 
 			/* found */
-			ping_port_rover = ident = result;
+			net->ipv4.ping_port_rover = ident = result;
 			break;
 next_port:
 			;
@@ -1146,6 +1144,8 @@ static int __net_init ping_v4_proc_init_net(struct net *net)
 	if (!proc_create_net("icmp", 0444, net->proc_net, &ping_v4_seq_ops,
 			sizeof(struct ping_iter_state)))
 		return -ENOMEM;
+
+	net->ipv4.ping_port_rover = get_random_u16();
 	return 0;
 }
 
-- 
2.51.0.318.gd7df087d1a-goog

[PATCH v3 net-next 4/4] inet: ping: use EXPORT_IPV6_MOD[_GPL]()

[Eric Dumazet]

There is no neeed to export ping symbols when CONFIG_IPV6=y

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/ping.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 98ccd4f9ed657d2bb9c013932d0c678f2b38a746..5321c5801c64dd2c20ba94fdcb5a677da4be02d7 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -56,7 +56,7 @@ struct ping_table {
 
 static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
-EXPORT_SYMBOL_GPL(pingv6_ops);
+EXPORT_IPV6_MOD_GPL(pingv6_ops);
 
 static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
 {
@@ -139,7 +139,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 	spin_unlock(&ping_table.lock);
 	return -EADDRINUSE;
 }
-EXPORT_SYMBOL_GPL(ping_get_port);
+EXPORT_IPV6_MOD_GPL(ping_get_port);
 
 void ping_unhash(struct sock *sk)
 {
@@ -154,7 +154,7 @@ void ping_unhash(struct sock *sk)
 	}
 	spin_unlock(&ping_table.lock);
 }
-EXPORT_SYMBOL_GPL(ping_unhash);
+EXPORT_IPV6_MOD_GPL(ping_unhash);
 
 /* Called under rcu_read_lock() */
 static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
@@ -274,7 +274,7 @@ int ping_init_sock(struct sock *sk)
 	put_group_info(group_info);
 	return ret;
 }
-EXPORT_SYMBOL_GPL(ping_init_sock);
+EXPORT_IPV6_MOD_GPL(ping_init_sock);
 
 void ping_close(struct sock *sk, long timeout)
 {
@@ -284,7 +284,7 @@ void ping_close(struct sock *sk, long timeout)
 
 	sk_common_release(sk);
 }
-EXPORT_SYMBOL_GPL(ping_close);
+EXPORT_IPV6_MOD_GPL(ping_close);
 
 static int ping_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 			    int addr_len)
@@ -462,7 +462,7 @@ int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	pr_debug("ping_v4_bind -> %d\n", err);
 	return err;
 }
-EXPORT_SYMBOL_GPL(ping_bind);
+EXPORT_IPV6_MOD_GPL(ping_bind);
 
 /*
  * Is this a supported type of ICMP message?
@@ -595,7 +595,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
 out:
 	return;
 }
-EXPORT_SYMBOL_GPL(ping_err);
+EXPORT_IPV6_MOD_GPL(ping_err);
 
 /*
  *	Copy and checksum an ICMP Echo packet from user space into a buffer
@@ -625,7 +625,7 @@ int ping_getfrag(void *from, char *to,
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(ping_getfrag);
+EXPORT_IPV6_MOD_GPL(ping_getfrag);
 
 static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
 				       struct flowi4 *fl4)
@@ -686,7 +686,7 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(ping_common_sendmsg);
+EXPORT_IPV6_MOD_GPL(ping_common_sendmsg);
 
 static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 {
@@ -931,7 +931,7 @@ int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 	pr_debug("ping_recvmsg -> %d\n", err);
 	return err;
 }
-EXPORT_SYMBOL_GPL(ping_recvmsg);
+EXPORT_IPV6_MOD_GPL(ping_recvmsg);
 
 static enum skb_drop_reason __ping_queue_rcv_skb(struct sock *sk,
 						 struct sk_buff *skb)
@@ -952,7 +952,7 @@ int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
 	return __ping_queue_rcv_skb(sk, skb) ? -1 : 0;
 }
-EXPORT_SYMBOL_GPL(ping_queue_rcv_skb);
+EXPORT_IPV6_MOD_GPL(ping_queue_rcv_skb);
 
 
 /*
@@ -980,7 +980,7 @@ enum skb_drop_reason ping_rcv(struct sk_buff *skb)
 	kfree_skb_reason(skb, SKB_DROP_REASON_NO_SOCKET);
 	return SKB_DROP_REASON_NO_SOCKET;
 }
-EXPORT_SYMBOL_GPL(ping_rcv);
+EXPORT_IPV6_MOD_GPL(ping_rcv);
 
 struct proto ping_prot = {
 	.name =		"PING",
@@ -1002,7 +1002,7 @@ struct proto ping_prot = {
 	.put_port =	ping_unhash,
 	.obj_size =	sizeof(struct inet_sock),
 };
-EXPORT_SYMBOL(ping_prot);
+EXPORT_IPV6_MOD(ping_prot);
 
 #ifdef CONFIG_PROC_FS
 
@@ -1067,7 +1067,7 @@ void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family)
 
 	return *pos ? ping_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
-EXPORT_SYMBOL_GPL(ping_seq_start);
+EXPORT_IPV6_MOD_GPL(ping_seq_start);
 
 static void *ping_v4_seq_start(struct seq_file *seq, loff_t *pos)
 {
@@ -1086,14 +1086,14 @@ void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 	++*pos;
 	return sk;
 }
-EXPORT_SYMBOL_GPL(ping_seq_next);
+EXPORT_IPV6_MOD_GPL(ping_seq_next);
 
 void ping_seq_stop(struct seq_file *seq, void *v)
 	__releases(ping_table.lock)
 {
 	spin_unlock(&ping_table.lock);
 }
-EXPORT_SYMBOL_GPL(ping_seq_stop);
+EXPORT_IPV6_MOD_GPL(ping_seq_stop);
 
 static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
 		int bucket)
-- 
2.51.0.318.gd7df087d1a-goog

Re: [PATCH v3 net-next 2/4] inet: ping: remove ping_hash()

[Yue Haibing]

On 2025/8/29 23:30, Eric Dumazet wrote:
> There is no point in keeping ping_hash().
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reviewed-by: David Ahern <dsahern@kernel.org>
> ---
> v3: Yue Haibing feedback (remove ping_hash() declaration in include/net/ping.h)
> v2: https://lore.kernel.org/netdev/20250828164149.3304323-1-edumazet@google.com/T/#md0f7cce22b5a0ce71c366b75be20db3a528e8e03
> 
>  include/net/ping.h |  1 -
>  net/ipv4/ping.c    | 10 ----------
>  net/ipv6/ping.c    |  1 -
>  3 files changed, 12 deletions(-)
> 
> diff --git a/include/net/ping.h b/include/net/ping.h
> index bc7779262e60350e2748c74731a5d6d71f1b9455..9634b8800814dae4568e86fdf917bbe41d429b4b 100644
> --- a/include/net/ping.h
> +++ b/include/net/ping.h
> @@ -54,7 +54,6 @@ struct pingfakehdr {
>  };
>  
>  int  ping_get_port(struct sock *sk, unsigned short ident);
> -int ping_hash(struct sock *sk);
>  void ping_unhash(struct sock *sk);
>  
>  int  ping_init_sock(struct sock *sk);
> diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
> index 74a0beddfcc41d8ba17792a11a9d027c9d590bac..75e1b0f5c697653e79166fde5f312f46b471344a 100644
> --- a/net/ipv4/ping.c
> +++ b/net/ipv4/ping.c
> @@ -67,7 +67,6 @@ static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
>  	pr_debug("hash(%u) = %u\n", num, res);
>  	return res;
>  }
> -EXPORT_SYMBOL_GPL(ping_hash);
>  
>  static inline struct hlist_head *ping_hashslot(struct ping_table *table,
>  					       struct net *net, unsigned int num)
> @@ -144,14 +143,6 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  }
>  EXPORT_SYMBOL_GPL(ping_get_port);
>  
> -int ping_hash(struct sock *sk)
> -{
> -	pr_debug("ping_hash(sk->port=%u)\n", inet_sk(sk)->inet_num);
> -	BUG(); /* "Please do not press this button again." */
> -
> -	return 0;
> -}
> -
>  void ping_unhash(struct sock *sk)
>  {
>  	struct inet_sock *isk = inet_sk(sk);
> @@ -1008,7 +999,6 @@ struct proto ping_prot = {
>  	.bind =		ping_bind,
>  	.backlog_rcv =	ping_queue_rcv_skb,
>  	.release_cb =	ip4_datagram_release_cb,
> -	.hash =		ping_hash,
>  	.unhash =	ping_unhash,
>  	.get_port =	ping_get_port,
>  	.put_port =	ping_unhash,
> diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
> index 82b0492923d458213ac7a6f9316158af2191e30f..d7a2cdaa26312b44f1fe502d3d40f3e27f961fa8 100644
> --- a/net/ipv6/ping.c
> +++ b/net/ipv6/ping.c
> @@ -208,7 +208,6 @@ struct proto pingv6_prot = {
>  	.recvmsg =	ping_recvmsg,
>  	.bind =		ping_bind,
>  	.backlog_rcv =	ping_queue_rcv_skb,
> -	.hash =		ping_hash,
>  	.unhash =	ping_unhash,
>  	.get_port =	ping_get_port,
>  	.put_port =	ping_unhash,

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>

Re: [PATCH v3 net-next 1/4] inet: ping: check sock_net() in ping_get_port() and ping_lookup()

[Yue Haibing]

On 2025/8/29 23:30, Eric Dumazet wrote:
> We need to check socket netns before considering them in ping_get_port().
> Otherwise, one malicious netns could 'consume' all ports.
> 
> Add corresponding check in ping_lookup().
> 
> Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reviewed-by: David Ahern <dsahern@kernel.org>
> ---
> 
> v2: added change to ping_lookup().
> v1: https://lore.kernel.org/netdev/CANn89iKF+DFQQyNJoYA2U-wf4QDPOUG2yNOd8fSu45hQ+TxJ5Q@mail.gmail.com/T/#u
> 
>  net/ipv4/ping.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
> index f119da68fc301be00719213ad33615b6754e6272..74a0beddfcc41d8ba17792a11a9d027c9d590bac 100644
> --- a/net/ipv4/ping.c
> +++ b/net/ipv4/ping.c
> @@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
>  
>  int ping_get_port(struct sock *sk, unsigned short ident)
>  {
> +	struct net *net = sock_net(sk);
>  	struct inet_sock *isk, *isk2;
>  	struct hlist_head *hlist;
>  	struct sock *sk2 = NULL;
> @@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		for (i = 0; i < (1L << 16); i++, result++) {
>  			if (!result)
>  				result++; /* avoid zero */
> -			hlist = ping_hashslot(&ping_table, sock_net(sk),
> -					    result);
> +			hlist = ping_hashslot(&ping_table, net, result);
>  			sk_for_each(sk2, hlist) {
> +				if (!net_eq(sock_net(sk2), net))
> +					continue;
>  				isk2 = inet_sk(sk2);
>  
>  				if (isk2->inet_num == result)
> @@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		if (i >= (1L << 16))
>  			goto fail;
>  	} else {
> -		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
> +		hlist = ping_hashslot(&ping_table, net, ident);
>  		sk_for_each(sk2, hlist) {
> +			if (!net_eq(sock_net(sk2), net))
> +				continue;
>  			isk2 = inet_sk(sk2);
>  
>  			/* BUG? Why is this reuse and not reuseaddr? ping.c
> @@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		pr_debug("was not hashed\n");
>  		sk_add_node_rcu(sk, hlist);
>  		sock_set_flag(sk, SOCK_RCU_FREE);
> -		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
> +		sock_prot_inuse_add(net, sk->sk_prot, 1);
>  	}
>  	spin_unlock(&ping_table.lock);
>  	return 0;
> @@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
>  	}
>  
>  	sk_for_each_rcu(sk, hslot) {
> +		if (!net_eq(sock_net(sk), net))
> +			continue;
>  		isk = inet_sk(sk);
>  
>  		pr_debug("iterate\n");

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>

Re: [PATCH v3 net-next 0/4] inet: ping: misc changes

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 29 Aug 2025 15:30:50 +0000 you wrote:
> First and third patches improve security a bit.
> 
> Second patch (ping_hash removal) is a cleanup.
> 
> Fourth patch uses EXPORT_IPV6_MOD[_GPL].
> 
> Eric Dumazet (4):
>   inet: ping: check sock_net() in ping_get_port() and ping_lookup()
>   inet: ping: remove ping_hash()
>   inet: ping: make ping_port_rover per netns
>   inet: ping: use EXPORT_IPV6_MOD[_GPL]()
> 
> [...]

Here is the summary with links:
  - [v3,net-next,1/4] inet: ping: check sock_net() in ping_get_port() and ping_lookup()
    https://git.kernel.org/netdev/net-next/c/59f26d86b2a1
  - [v3,net-next,2/4] inet: ping: remove ping_hash()
    https://git.kernel.org/netdev/net-next/c/10343e7e6c7c
  - [v3,net-next,3/4] inet: ping: make ping_port_rover per netns
    https://git.kernel.org/netdev/net-next/c/689adb36bd43
  - [v3,net-next,4/4] inet: ping: use EXPORT_IPV6_MOD[_GPL]()
    https://git.kernel.org/netdev/net-next/c/51ba2d26bcc6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html