Jonathon Reinhart 6c1ea8bee7 net: Only allow init netns to set default tcp cong to a restricted algo ... commit 8d432592f30fcc34ef5a10aac4887b4897884493 upstream. tcp_set_default_congestion_control() is netns-safe in that it writes to &net->ipv4.tcp_congestion_control, but it also sets ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended side-effect of changing the global net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in non-init netns") Resolve this netns "leak" by only allowing the init netns to set the default algorithm to one that is restricted. This restriction could be removed if tcp_allowed_congestion_control were namespace-ified in the future. This bug was uncovered with https://github.com/JonathonReinhart/linux-netns-sysctl-verify Fixes: 6670e15244 ("tcp: Namespace-ify sysctl_tcp_default_congestion_control") Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-14 09:50:46 +02:00
..
bpfilter
netfilter	netfilter: arp_tables: add pre_exit hook for table unregister	2021-04-21 13:00:56 +02:00
af_inet.c
ah4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-04-14 08:42:05 +02:00
arp.c	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
bpf_tcp_ca.c	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
cipso_ipv4.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
datagram.c
devinet.c
esp4_offload.c	xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets	2021-04-14 08:42:07 +02:00
esp4.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-04-14 08:42:05 +02:00
fib_frontend.c	ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()	2021-01-12 20:18:12 +01:00
fib_lookup.h
fib_notifier.c
fib_rules.c
fib_semantics.c
fib_trie.c
fou.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
gre_demux.c	erspan: fix version 1 check in gre_parse_header()	2021-01-12 20:18:12 +01:00
gre_offload.c
icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
igmp.c
inet_connection_sock.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-30 14:31:59 +02:00
inet_diag.c	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()	2020-11-17 16:08:36 -08:00
inet_fragment.c
inet_hashtables.c	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
inet_timewait_sock.c
inetpeer.c
ip_forward.c
ip_fragment.c
ip_gre.c	ip_gre: set dev->hard_header_len and dev->needed_headroom properly	2020-10-13 18:35:29 -07:00
ip_input.c
ip_options.c
ip_output.c	net: ip: always refragment ip defragmented packets	2021-01-17 14:16:56 +01:00
ip_sockglue.c
ip_tunnel_core.c	tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies	2020-11-09 15:39:39 -08:00
ip_tunnel.c	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-17 17:06:12 +01:00
ip_vti.c	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-17 17:06:12 +01:00
ipcomp.c
ipconfig.c	net: ipconfig: Avoid spurious blank lines in boot log	2020-12-26 16:02:38 +01:00
ipip.c
ipmr_base.c
ipmr.c	ipmr: Use full VIF ID in netlink cache reports	2020-09-10 12:25:51 -07:00
Kconfig
Makefile
metrics.c
netfilter.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
netlink.c
nexthop.c	nexthop: Do not flush blackhole nexthops when loopback goes down	2021-03-17 17:06:14 +01:00
ping.c
proc.c	tcp: skip DSACKs with dubious sequence ranges	2020-09-24 20:15:45 -07:00
protocol.c
raw_diag.c
raw.c	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
route.c	inet: use bigger hash table for IP ID generation	2021-05-14 09:50:30 +02:00
syncookies.c	net: Update window_clamp if SOCK_RCVBUF is set	2020-11-10 17:42:35 -08:00
sysctl_net_ipv4.c	net: Make tcp_allowed_congestion_control readonly in non-init netns	2021-04-21 13:00:57 +02:00
tcp_bbr.c	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate	2020-11-17 11:03:22 -08:00
tcp_bic.c
tcp_bpf.c	bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect	2020-11-18 00:12:34 +01:00
tcp_cdg.c
tcp_cong.c	net: Only allow init netns to set default tcp cong to a restricted algo	2021-05-14 09:50:46 +02:00
tcp_cubic.c
tcp_dctcp.c
tcp_dctcp.h
tcp_diag.c
tcp_fastopen.c
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-02-03 23:28:52 +01:00
tcp_ipv4.c	tcp: Fix potential use-after-free due to double kfree()	2021-01-27 11:55:28 +01:00
tcp_lp.c
tcp_metrics.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
tcp_minisocks.c	tcp: relookup sock for RST+ACK packets handled by obsolete req sock	2021-03-30 14:31:59 +02:00
tcp_nv.c
tcp_offload.c
tcp_output.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-02-03 23:28:51 +01:00
tcp_rate.c
tcp_recovery.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-02-03 23:28:52 +01:00
tcp_scalable.c
tcp_timer.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-02-03 23:28:51 +01:00
tcp_ulp.c
tcp_vegas.c	tcp: use semicolons rather than commas to separate statements	2020-10-13 17:11:52 -07:00
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c	tcp: add sanity tests to TCP_QUEUE_SEQ	2021-03-17 17:06:11 +01:00
tunnel4.c
udp_bpf.c
udp_diag.c
udp_impl.h
udp_offload.c	net: Fix gro aggregation for udp encaps with zero csum	2021-03-17 17:06:11 +01:00
udp_tunnel_core.c
udp_tunnel_nic.c	udp_tunnel: add the ability to share port tables	2020-09-28 12:50:12 -07:00
udp_tunnel_stub.c
udp.c	udp: never accept GSO_FRAGLIST packets	2021-05-14 09:50:31 +02:00
udplite.c
xfrm4_input.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c	xfrm: interface: fix the priorities for ipip and ipv6 tunnels	2020-10-09 12:29:48 +02:00