[PATCH net v2 1/1] tcp: check congestion control restriction first

[PATCH net v2 1/1] tcp: check congestion control restriction first

[Zhiling Zou]

tcp_set_default_congestion_control() takes a reference to an algorithm
before checking whether a non-init network namespace may select it. A
rejected request returns -EPERM without dropping the reference.

This affects module-backed algorithms too; BPF is not required. For
example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
non-init network namespace can repeatedly request it as the default
although it is not in tcp_allowed_congestion_control. Each rejected
write leaks a module reference. Since module->refcnt is an atomic_t,
2^31 such writes can make it negative; later module_put() calls warn,
and rmmod can hit the BUG_ON() in try_release_module_ref().

Check the namespace restriction before acquiring the reference, as
tcp_set_congestion_control() already does.

Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
---
changes in v2:
  - Check the namespace restriction before bpf_try_module_get(), following
    tcp_set_congestion_control().
  - Describe the module-backed reference leak and module refcount overflow.

 net/ipv4/tcp_cong.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 8e83ef81fc187..e3f462f161dd6 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
 	ca = tcp_ca_find_autoload(name);
 	if (!ca) {
 		ret = -ENOENT;
-	} else if (!bpf_try_module_get(ca, ca->owner)) {
-		ret = -EBUSY;
 	} else if (!net_eq(net, &init_net) &&
 			!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
 		/* Only init netns can set default to a restricted algorithm */
 		ret = -EPERM;
+	} else if (!bpf_try_module_get(ca, ca->owner)) {
+		ret = -EBUSY;
 	} else {
 		prev = xchg(&net->ipv4.tcp_congestion_control, ca);
 		if (prev)
-- 
2.55.0

Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[Kuniyuki Iwashima]

On Tue, 27 Oct 2026 12:46:49 +0800, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
> 
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
> 
> Check the namespace restriction before acquiring the reference, as
> tcp_set_congestion_control() already does.
> 
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[Eric Dumazet]

Le mar. 27 oct. 2026 à 06:00, Kuniyuki Iwashima <kuniyu@google.com> a écrit :
>
> On Tue, 27 Oct 2026 12:46:49 +0800, Zhiling Zou wrote:
> > tcp_set_default_congestion_control() takes a reference to an algorithm
> > before checking whether a non-init network namespace may select it. A
> > rejected request returns -EPERM without dropping the reference.
> >
> > This affects module-backed algorithms too; BPF is not required. For
> > example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> > non-init network namespace can repeatedly request it as the default
> > although it is not in tcp_allowed_congestion_control. Each rejected
> > write leaks a module reference. Since module->refcnt is an atomic_t,
> > 2^31 such writes can make it negative; later module_put() calls warn,
> > and rmmod can hit the BUG_ON() in try_release_module_ref().
> >
> > Check the namespace restriction before acquiring the reference, as
> > tcp_set_congestion_control() already does.
> >
> > Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> > Cc: stable@vger.kernel.org
> > Reported-by: Vega <vega@nebusec.ai>
> > Suggested-by: Eric Dumazet <edumazet@kernel.org>
> > Assisted-by: LLM
> > Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Reviewed-by: Eric Dumazet <edumazet@kernel.org>

Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[Jiayuan Chen]

On 10/27/26 12:46 PM, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
>
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
>
> Check the namespace restriction before acquiring the reference, as
> tcp_set_congestion_control() already does.
>
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> ---
> changes in v2:
>    - Check the namespace restriction before bpf_try_module_get(), following
>      tcp_set_congestion_control().
>    - Describe the module-backed reference leak and module refcount overflow.
>
>   net/ipv4/tcp_cong.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
> index 8e83ef81fc187..e3f462f161dd6 100644
> --- a/net/ipv4/tcp_cong.c
> +++ b/net/ipv4/tcp_cong.c
> @@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
>   	ca = tcp_ca_find_autoload(name);
>   	if (!ca) {
>   		ret = -ENOENT;
> -	} else if (!bpf_try_module_get(ca, ca->owner)) {
> -		ret = -EBUSY;
>   	} else if (!net_eq(net, &init_net) &&
>   			!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
>   		/* Only init netns can set default to a restricted algorithm */
>   		ret = -EPERM;
> +	} else if (!bpf_try_module_get(ca, ca->owner)) {
> +		ret = -EBUSY;
>   	} else {
>   		prev = xchg(&net->ipv4.tcp_congestion_control, ca);
>   		if (prev)

Re: [PATCH net v2 1/1] tcp: check congestion control restriction first

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue, 27 Oct 2026 12:46:49 +0800 you wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
> 
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
> 
> [...]

Here is the summary with links:
  - [net,v2,1/1] tcp: check congestion control restriction first
    https://git.kernel.org/netdev/net/c/dda51b737216

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html