inet: ping: make ping_port_rover per netns

Provide isolation between netns for ping idents.

Randomize initial ping_port_rover value at netns creation.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250829153054.474201-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 6373e3f17da84ebc5c11058763932e595f0fd205..54a7d187f62a2e995076e85f1e6b2fd70f84b2c1 100644 (file)
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -251,6 +251,7 @@ struct netns_ipv4 {
        int sysctl_igmp_qrv;
 
        struct ping_group_range ping_group_range;
+       u16                     ping_port_rover;
 
        atomic_t dev_addr_genid;
 

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 75e1b0f5c697653e79166fde5f312f46b471344a..98ccd4f9ed657d2bb9c013932d0c678f2b38a746 100644 (file)
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -58,8 +58,6 @@ static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
 
-static u16 ping_port_rover;
-
 static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
 {
        u32 res = (num + net_hash_mix(net)) & mask;
@@ -84,12 +82,12 @@ int ping_get_port(struct sock *sk, unsigned short ident)
        isk = inet_sk(sk);
        spin_lock(&ping_table.lock);
        if (ident == 0) {
+               u16 result = net->ipv4.ping_port_rover + 1;
                u32 i;
-               u16 result = ping_port_rover + 1;
 
                for (i = 0; i < (1L << 16); i++, result++) {
                        if (!result)
-                               result++; /* avoid zero */
+                               continue; /* avoid zero */
                        hlist = ping_hashslot(&ping_table, net, result);
                        sk_for_each(sk2, hlist) {
                                if (!net_eq(sock_net(sk2), net))
@@ -101,7 +99,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
                        }
 
                        /* found */
-                       ping_port_rover = ident = result;
+                       net->ipv4.ping_port_rover = ident = result;
                        break;
 next_port:
                        ;
@@ -1146,6 +1144,8 @@ static int __net_init ping_v4_proc_init_net(struct net *net)
        if (!proc_create_net("icmp", 0444, net->proc_net, &ping_v4_seq_ops,
                        sizeof(struct ping_iter_state)))
                return -ENOMEM;
+
+       net->ipv4.ping_port_rover = get_random_u16();
        return 0;
 }