* Re: [PATCH net v2 1/1] tcp: check congestion control restriction first
2026-10-27 4:46 [PATCH net v2 1/1] tcp: check congestion control restriction first Zhiling Zou
@ 2026-10-27 4:51 ` netdev-bot+sinfo
2026-10-27 5:00 ` Kuniyuki Iwashima
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: netdev-bot+sinfo @ 2026-10-27 4:51 UTC (permalink / raw)
To: Zhiling Zou
Cc: edumazet, netdev, bpf, ncardwell, kuniyu, davem, pabeni, horms,
jonathon.reinhart, vega
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net v2 1/1] tcp: check congestion control restriction first
2026-10-27 4:46 [PATCH net v2 1/1] tcp: check congestion control restriction first Zhiling Zou
2026-10-27 4:51 ` netdev-bot+sinfo
@ 2026-10-27 5:00 ` Kuniyuki Iwashima
2026-10-27 5:31 ` Eric Dumazet
2026-10-29 4:51 ` Jiayuan Chen
2026-10-29 14:40 ` patchwork-bot+netdevbpf
3 siblings, 1 reply; 6+ messages in thread
From: Kuniyuki Iwashima @ 2026-10-27 5:00 UTC (permalink / raw)
To: Zhiling Zou
Cc: edumazet, netdev, bpf, ncardwell, davem, pabeni, horms,
jonathon.reinhart, vega
On Tue, 27 Oct 2026 12:46:49 +0800, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
>
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
>
> Check the namespace restriction before acquiring the reference, as
> tcp_set_congestion_control() already does.
>
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net v2 1/1] tcp: check congestion control restriction first
2026-10-27 5:00 ` Kuniyuki Iwashima
@ 2026-10-27 5:31 ` Eric Dumazet
0 siblings, 0 replies; 6+ messages in thread
From: Eric Dumazet @ 2026-10-27 5:31 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: Zhiling Zou, netdev, bpf, ncardwell, davem, pabeni, horms,
jonathon.reinhart, vega
Le mar. 27 oct. 2026 à 06:00, Kuniyuki Iwashima <kuniyu@google.com> a écrit :
>
> On Tue, 27 Oct 2026 12:46:49 +0800, Zhiling Zou wrote:
> > tcp_set_default_congestion_control() takes a reference to an algorithm
> > before checking whether a non-init network namespace may select it. A
> > rejected request returns -EPERM without dropping the reference.
> >
> > This affects module-backed algorithms too; BPF is not required. For
> > example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> > non-init network namespace can repeatedly request it as the default
> > although it is not in tcp_allowed_congestion_control. Each rejected
> > write leaks a module reference. Since module->refcnt is an atomic_t,
> > 2^31 such writes can make it negative; later module_put() calls warn,
> > and rmmod can hit the BUG_ON() in try_release_module_ref().
> >
> > Check the namespace restriction before acquiring the reference, as
> > tcp_set_congestion_control() already does.
> >
> > Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> > Cc: stable@vger.kernel.org
> > Reported-by: Vega <vega@nebusec.ai>
> > Suggested-by: Eric Dumazet <edumazet@kernel.org>
> > Assisted-by: LLM
> > Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net v2 1/1] tcp: check congestion control restriction first
2026-10-27 4:46 [PATCH net v2 1/1] tcp: check congestion control restriction first Zhiling Zou
2026-10-27 4:51 ` netdev-bot+sinfo
2026-10-27 5:00 ` Kuniyuki Iwashima
@ 2026-10-29 4:51 ` Jiayuan Chen
2026-10-29 14:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 6+ messages in thread
From: Jiayuan Chen @ 2026-10-29 4:51 UTC (permalink / raw)
To: Zhiling Zou, edumazet, netdev, bpf
Cc: ncardwell, kuniyu, davem, pabeni, horms, jonathon.reinhart, vega
On 10/27/26 12:46 PM, Zhiling Zou wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
>
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
>
> Check the namespace restriction before acquiring the reference, as
> tcp_set_congestion_control() already does.
>
> Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> changes in v2:
> - Check the namespace restriction before bpf_try_module_get(), following
> tcp_set_congestion_control().
> - Describe the module-backed reference leak and module refcount overflow.
>
> net/ipv4/tcp_cong.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
> index 8e83ef81fc187..e3f462f161dd6 100644
> --- a/net/ipv4/tcp_cong.c
> +++ b/net/ipv4/tcp_cong.c
> @@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
> ca = tcp_ca_find_autoload(name);
> if (!ca) {
> ret = -ENOENT;
> - } else if (!bpf_try_module_get(ca, ca->owner)) {
> - ret = -EBUSY;
> } else if (!net_eq(net, &init_net) &&
> !(ca->flags & TCP_CONG_NON_RESTRICTED)) {
> /* Only init netns can set default to a restricted algorithm */
> ret = -EPERM;
> + } else if (!bpf_try_module_get(ca, ca->owner)) {
> + ret = -EBUSY;
> } else {
> prev = xchg(&net->ipv4.tcp_congestion_control, ca);
> if (prev)
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net v2 1/1] tcp: check congestion control restriction first
2026-10-27 4:46 [PATCH net v2 1/1] tcp: check congestion control restriction first Zhiling Zou
` (2 preceding siblings ...)
2026-10-29 4:51 ` Jiayuan Chen
@ 2026-10-29 14:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-10-29 14:40 UTC (permalink / raw)
To: Zhiling Zou
Cc: edumazet, netdev, bpf, ncardwell, kuniyu, davem, pabeni, horms,
jonathon.reinhart, vega
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 27 Oct 2026 12:46:49 +0800 you wrote:
> tcp_set_default_congestion_control() takes a reference to an algorithm
> before checking whether a non-init network namespace may select it. A
> rejected request returns -EPERM without dropping the reference.
>
> This affects module-backed algorithms too; BPF is not required. For
> example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
> non-init network namespace can repeatedly request it as the default
> although it is not in tcp_allowed_congestion_control. Each rejected
> write leaks a module reference. Since module->refcnt is an atomic_t,
> 2^31 such writes can make it negative; later module_put() calls warn,
> and rmmod can hit the BUG_ON() in try_release_module_ref().
>
> [...]
Here is the summary with links:
- [net,v2,1/1] tcp: check congestion control restriction first
https://git.kernel.org/netdev/net/c/dda51b737216
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread