From: Jakub Kicinski Date: Fri, 8 May 2026 21:59:17 +0000 (-0700) Subject: Merge branch 'ipv6-flowlabel-per-netns-budget-for-unprivileged-callers' X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dffddaa0cea5849e2bd1f357d166a86c2f6cded4;p=thirdparty%2Fkernel%2Fstable.git Merge branch 'ipv6-flowlabel-per-netns-budget-for-unprivileged-callers' Maoyi Xie says: ==================== ipv6: flowlabel: per-netns budget for unprivileged callers From: Maoyi Xie This series fixes the cross-tenant DoS in net/ipv6/ip6_flowlabel.c. v1 through v6 were single-patch postings, each in its own thread. v6 review pointed out that the existing fl_size read in mem_check() and the corresponding write in fl_intern() are not in the same critical section. v7 split the work into 2 patches. Patch 1/2 is a prerequisite. It moves spin_lock_bh(&ip6_fl_lock) and the matching unlock from fl_intern() into its only caller ipv6_flowlabel_get(), so the mem_check() call runs under the same critical section as the fl_intern() insert. With all writers and the read of fl_size under the lock, fl_size is converted from atomic_t to plain int. This is independent of the per-netns budget. It also makes 2/2 backportable without conflicts. Patch 2/2 is the v6 patch, rebased on 1/2. - flowlabel_count is plain int rather than atomic_t, since the previous patch put all writers and readers under ip6_fl_lock. - In ip6_fl_gc(), fl_free() is now placed below the fl_size and flowlabel_count decrements, removing the v6 cache of fl->fl_net. - In ip6_fl_purge(), fl_free() stays in its original position. The function argument net is used for flowlabel_count. - mem_check() uses spaces around the / operator on all four expressions, addressing the checkpatch note in v6 review. Numeric budget (preserved from v6): pre-patch: global non-CAP_NET_ADMIN budget = FL_MAX_SIZE - FL_MAX_SIZE/4 = 4096 - 1024 = 3072 per-actor reach = 3072 post-patch: FL_MAX_SIZE doubled to 8192 global non-CAP_NET_ADMIN budget = 8192 - 2048 = 6144 per-netns ceiling = 6144 / 2 = 3072 per-actor reach = 3072 (preserved) CAP_NET_ADMIN against init_user_ns still bypasses both caps. Reproducer (KASAN VM, 4 cores, qemu): unprivileged netns A holds 3072 flowlabels via 100 procs. Fresh unprivileged netns B then allocates 32 flowlabels (the FL_MAX_PER_SOCK ceiling for one socket), the same as a clean baseline. Without the per-netns ceiling, netns A could push fl_size past FL_MAX_SIZE - FL_MAX_SIZE / 4 and netns B would see allocations denied. ==================== Link: https://patch.msgid.link/20260506082416.2259567-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski --- dffddaa0cea5849e2bd1f357d166a86c2f6cded4