netdev - Re: [PATCH v3 net-next 1/4] inet: ping: check sock_net() in ping_get_port() and ping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <466c11eb-0fc0-44b3-b0b2-39634fc637b1@huawei.com>
Date: Mon, 1 Sep 2025 09:57:10 +0800
From: Yue Haibing <yuehaibing@...wei.com>
To: Eric Dumazet <edumazet@...gle.com>, "David S . Miller"
	<davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>
CC: Simon Horman <horms@...nel.org>, David Ahern <dsahern@...nel.org>,
	<netdev@...r.kernel.org>, <eric.dumazet@...il.com>
Subject: Re: [PATCH v3 net-next 1/4] inet: ping: check sock_net() in
 ping_get_port() and ping_lookup()

On 2025/8/29 23:30, Eric Dumazet wrote:
> We need to check socket netns before considering them in ping_get_port().
> Otherwise, one malicious netns could 'consume' all ports.
> 
> Add corresponding check in ping_lookup().
> 
> Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reviewed-by: David Ahern <dsahern@...nel.org>
> ---
> 
> v2: added change to ping_lookup().
> v1: https://lore.kernel.org/netdev/CANn89iKF+DFQQyNJoYA2U-wf4QDPOUG2yNOd8fSu45hQ+TxJ5Q@mail.gmail.com/T/#u
> 
>  net/ipv4/ping.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
> index f119da68fc301be00719213ad33615b6754e6272..74a0beddfcc41d8ba17792a11a9d027c9d590bac 100644
> --- a/net/ipv4/ping.c
> +++ b/net/ipv4/ping.c
> @@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
>  
>  int ping_get_port(struct sock *sk, unsigned short ident)
>  {
> +	struct net *net = sock_net(sk);
>  	struct inet_sock *isk, *isk2;
>  	struct hlist_head *hlist;
>  	struct sock *sk2 = NULL;
> @@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		for (i = 0; i < (1L << 16); i++, result++) {
>  			if (!result)
>  				result++; /* avoid zero */
> -			hlist = ping_hashslot(&ping_table, sock_net(sk),
> -					    result);
> +			hlist = ping_hashslot(&ping_table, net, result);
>  			sk_for_each(sk2, hlist) {
> +				if (!net_eq(sock_net(sk2), net))
> +					continue;
>  				isk2 = inet_sk(sk2);
>  
>  				if (isk2->inet_num == result)
> @@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		if (i >= (1L << 16))
>  			goto fail;
>  	} else {
> -		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
> +		hlist = ping_hashslot(&ping_table, net, ident);
>  		sk_for_each(sk2, hlist) {
> +			if (!net_eq(sock_net(sk2), net))
> +				continue;
>  			isk2 = inet_sk(sk2);
>  
>  			/* BUG? Why is this reuse and not reuseaddr? ping.c
> @@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
>  		pr_debug("was not hashed\n");
>  		sk_add_node_rcu(sk, hlist);
>  		sock_set_flag(sk, SOCK_RCU_FREE);
> -		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
> +		sock_prot_inuse_add(net, sk->sk_prot, 1);
>  	}
>  	spin_unlock(&ping_table.lock);
>  	return 0;
> @@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
>  	}
>  
>  	sk_for_each_rcu(sk, hslot) {
> +		if (!net_eq(sock_net(sk), net))
> +			continue;
>  		isk = inet_sk(sk);
>  
>  		pr_debug("iterate\n");

Reviewed-by: Yue Haibing <yuehaibing@...wei.com>