[PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[Greg Kroah-Hartman]

current->nsproxy is should not be accessed directly as syzbot has found
that it could be NULL at times, causing crashes.  Fix up the af_vsock
sysctl handlers to use container_of() to deal with the current net
namespace instead of attempting to rely on current.

This is the same type of change done in commit 7f5611cbc487 ("rds:
sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")

Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

Note, this is compile-tested only.  Some of my scripts found this when
looking for places that are missing fixes that were applied to other
parts of the kernel.  I think the af_vsock code uses namespaces, but as
I don't know the network stack at all I figured I would let you all
review it to tell me how wrong I got this change and all is fine with
the original code.

thanks,

greg k-h

 net/vmw_vsock/af_vsock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9880756d9eff..f4062c6a1944 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2825,7 +2825,7 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write,
 	if (write)
 		return -EPERM;
 
-	net = current->nsproxy->net_ns;
+	net = container_of(table->data, struct net, vsock.mode);
 
 	return __vsock_net_mode_string(table, write, buffer, lenp, ppos,
 				       vsock_net_mode(net), NULL);
@@ -2838,7 +2838,7 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write,
 	struct net *net;
 	int ret;
 
-	net = current->nsproxy->net_ns;
+	net = container_of(table->data, struct net, vsock.child_ns_mode);
 
 	ret = __vsock_net_mode_string(table, write, buffer, lenp, ppos,
 				      vsock_net_child_mode(net), &new_mode);
-- 
2.53.0

Re: [PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[Bobby Eshleman]

On Mon, Feb 23, 2026 at 06:32:18PM +0100, Greg Kroah-Hartman wrote:
> current->nsproxy is should not be accessed directly as syzbot has found
> that it could be NULL at times, causing crashes.  Fix up the af_vsock
> sysctl handlers to use container_of() to deal with the current net
> namespace instead of attempting to rely on current.
> 
> This is the same type of change done in commit 7f5611cbc487 ("rds:
> sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")
> 
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_2000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> 
> Note, this is compile-tested only.  Some of my scripts found this when
> looking for places that are missing fixes that were applied to other
> parts of the kernel.  I think the af_vsock code uses namespaces, but as
> I don't know the network stack at all I figured I would let you all
> review it to tell me how wrong I got this change and all is fine with
> the original code.
> 
> thanks,
> 
> greg k-h
> 
>  net/vmw_vsock/af_vsock.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 9880756d9eff..f4062c6a1944 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -2825,7 +2825,7 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write,
>  	if (write)
>  		return -EPERM;
>  
> -	net = current->nsproxy->net_ns;
> +	net = container_of(table->data, struct net, vsock.mode);
>  
>  	return __vsock_net_mode_string(table, write, buffer, lenp, ppos,
>  				       vsock_net_mode(net), NULL);
> @@ -2838,7 +2838,7 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write,
>  	struct net *net;
>  	int ret;
>  
> -	net = current->nsproxy->net_ns;
> +	net = container_of(table->data, struct net, vsock.child_ns_mode);
>  
>  	ret = __vsock_net_mode_string(table, write, buffer, lenp, ppos,
>  				      vsock_net_child_mode(net), &new_mode);
> -- 
> 2.53.0
> 

Thanks Greg. LGTM, and passed all tests on my test setup.

I can't say if nsproxy can be null here in particular but better safe
than sorry.

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>

Re: [PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[Stefano Garzarella]

On Mon, Feb 23, 2026 at 06:32:18PM +0100, Greg Kroah-Hartman wrote:
>current->nsproxy is should not be accessed directly as syzbot has found
                   ^
nit: "is" can be removed

>that it could be NULL at times, causing crashes.  Fix up the af_vsock
>sysctl handlers to use container_of() to deal with the current net
>namespace instead of attempting to rely on current.
>
>This is the same type of change done in commit 7f5611cbc487 ("rds:
>sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")
>
>Cc: Stefano Garzarella <sgarzare@redhat.com>
>Cc: stable <stable@kernel.org>

I'm not sure this is stable material since these changes landed in the 
latest merge window (v7.0-rc1), but yeah, you know better than me, so 
there could be a reason.

If needed, maybe we can also add:

Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")

>Assisted-by: gkh_clanker_2000
>Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>---
>
>Note, this is compile-tested only.  Some of my scripts found this when
>looking for places that are missing fixes that were applied to other
>parts of the kernel.  I think the af_vsock code uses namespaces, but as
>I don't know the network stack at all I figured I would let you all
>review it to tell me how wrong I got this change and all is fine with
>the original code.

Thanks! LGTM and tests are fine!

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

>
>thanks,
>
>greg k-h
>
> net/vmw_vsock/af_vsock.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
>index 9880756d9eff..f4062c6a1944 100644
>--- a/net/vmw_vsock/af_vsock.c
>+++ b/net/vmw_vsock/af_vsock.c
>@@ -2825,7 +2825,7 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write,
> 	if (write)
> 		return -EPERM;
>
>-	net = current->nsproxy->net_ns;
>+	net = container_of(table->data, struct net, vsock.mode);
>
> 	return __vsock_net_mode_string(table, write, buffer, lenp, ppos,
> 				       vsock_net_mode(net), NULL);
>@@ -2838,7 +2838,7 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write,
> 	struct net *net;
> 	int ret;
>
>-	net = current->nsproxy->net_ns;
>+	net = container_of(table->data, struct net, vsock.child_ns_mode);
>
> 	ret = __vsock_net_mode_string(table, write, buffer, lenp, ppos,
> 				      vsock_net_child_mode(net), &new_mode);
>-- 
>2.53.0
>

Re: [PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[Greg Kroah-Hartman]

On Tue, Feb 24, 2026 at 10:54:58AM +0100, Stefano Garzarella wrote:
> On Mon, Feb 23, 2026 at 06:32:18PM +0100, Greg Kroah-Hartman wrote:
> > current->nsproxy is should not be accessed directly as syzbot has found
>                   ^
> nit: "is" can be removed
> 
> > that it could be NULL at times, causing crashes.  Fix up the af_vsock
> > sysctl handlers to use container_of() to deal with the current net
> > namespace instead of attempting to rely on current.
> > 
> > This is the same type of change done in commit 7f5611cbc487 ("rds:
> > sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")
> > 
> > Cc: Stefano Garzarella <sgarzare@redhat.com>
> > Cc: stable <stable@kernel.org>
> 
> I'm not sure this is stable material since these changes landed in the
> latest merge window (v7.0-rc1), but yeah, you know better than me, so there
> could be a reason.
> 
> If needed, maybe we can also add:
> 
> Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")

Ah, I missed that this was a "new" thing, you are right, cc: stable
wasn't needed, and the fixes: tag is good to have.  I don't normally add
those as it's up to me to do the backports and I can figure it out on my
own when they hit Linus's tree :)

> > Assisted-by: gkh_clanker_2000
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > 
> > Note, this is compile-tested only.  Some of my scripts found this when
> > looking for places that are missing fixes that were applied to other
> > parts of the kernel.  I think the af_vsock code uses namespaces, but as
> > I don't know the network stack at all I figured I would let you all
> > review it to tell me how wrong I got this change and all is fine with
> > the original code.
> 
> Thanks! LGTM and tests are fine!
> 
> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Great, thanks for testing and the review!

greg k-h

Re: [PATCH net] vsock: Use container_of() to get net namespace in sysctl handlers

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 23 Feb 2026 18:32:18 +0100 you wrote:
> current->nsproxy is should not be accessed directly as syzbot has found
> that it could be NULL at times, causing crashes.  Fix up the af_vsock
> sysctl handlers to use container_of() to deal with the current net
> namespace instead of attempting to rely on current.
> 
> This is the same type of change done in commit 7f5611cbc487 ("rds:
> sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")
> 
> [...]

Here is the summary with links:
  - [net] vsock: Use container_of() to get net namespace in sysctl handlers
    https://git.kernel.org/netdev/net/c/5cc619583c7e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html