Matthieu Baerts (NGI0) b4c31236c0 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy ...

BugLink: https://bugs.launchpad.net/bugs/2106770

commit 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c upstream.

As mentioned in a previous commit of this series, using the 'net'
structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only
  from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
  (null-ptr-deref), e.g. when the current task is exiting, as spotted by
  syzbot [1] using acct(2).

The per-netns structure can be obtained from the table->data using
container_of(), then the 'net' one can be retrieved from the listen
socket (if available).

Fixes: c6a58ffed5 ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1]
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-9-5df34b2083e8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CVE-2025-21635
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>

2025-04-15 19:59:55 +03:00

..

af_rds.c

net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv

2024-01-22 11:24:00 +00:00

bind.c

treewide: use get_random_{u8,u16}() when possible, part 2

2022-10-11 17:42:58 -06:00

cong.c

net: rds: delete duplicated words

2020-09-18 14:12:43 -07:00

connection.c

rds: memory leak in __rds_conn_create()

2021-12-14 12:51:52 +00:00

ib_cm.c

rds: ib: Remove two ib_modify_qp() calls

2021-04-12 19:51:48 -03:00

ib_frmr.c

net/rds: dma_map_sg is entitled to merge entries

2021-08-18 15:35:50 -07:00

ib_mr.h

RDMA/rds: Remove FMR support for memory registration

2020-06-02 20:32:53 -03:00

ib_rdma.c

…

ib_recv.c

net: add missing includes of linux/sched/clock.h

2023-01-27 11:19:46 +00:00

ib_ring.c

rds: Fix spelling mistakes

2021-05-31 22:45:05 -07:00

ib_send.c

UBUNTU: SAUCE: (no-up) rds_ib_send() -- prevent local pings triggering BUG_ON()

2024-03-11 09:39:15 +01:00

ib_stats.c

…

ib_sysctl.c

…

ib.c

RDMA: Split kernel-only global device caps from uverbs device caps

2022-04-06 15:02:13 -03:00

ib.h

rds: stop using dmapool

2020-11-17 15:22:06 -04:00

info.c

…

info.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

loop.c

…

loop.h

rds: clean up loopback rds_connections on netns deletion

2018-06-27 10:11:03 +09:00

Makefile

RDMA/rds: Remove FMR support for memory registration

2020-06-02 20:32:53 -03:00

message.c

rds: rds_rm_zerocopy_callback() correct order for list_add_tail()

2023-02-13 09:33:39 +00:00

page.c

…

rdma_transport.c

net: rds: Fix possible NULL-pointer dereference

2023-09-20 08:49:03 +01:00

rdma_transport.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

rdma.c

net/rds: fix possible cp null dereference

2024-06-07 14:48:20 +02:00

rds_single_path.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rds.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

recv.c

net:rds: Fix possible deadlock in rds_message_put

2024-02-13 10:25:30 +01:00

send.c

rds: introduce acquire/release ordering in acquire/release_in_xmit()

2024-05-01 15:55:07 +02:00

stats.c

rds: check for excessive looping in rds_send_xmit

2019-08-15 12:04:24 -07:00

sysctl.c

net: rds: fix coding style issues

2016-06-18 21:34:09 -07:00

tcp_connect.c

net: prevent address rewrite in kernel_bind()

2023-10-01 19:31:29 +01:00

tcp_listen.c

ipv6: annotate data-races around np->mcast_oif

2023-12-11 10:59:17 +00:00

tcp_recv.c

net/sock: Introduce trace_sk_data_ready()

2023-01-23 11:26:50 +00:00

tcp_send.c

rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage

2023-06-24 15:50:12 -07:00

tcp_stats.c

…

tcp.c

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

2025-04-15 19:59:55 +03:00

tcp.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

threads.c

rds: Fix fall-through warnings for Clang

2021-05-17 20:00:27 -05:00

transport.c

…