From: Zhiling Zou tcp_child_ehash_entries controls the size of the private TCP established hash table allocated for subsequently created child network namespaces. The value is consumed during child netns creation by tcp_set_hashinfo() and passed to inet_pernet_hashinfo_alloc(), which can allocate a large per-netns ehash. The sysctl is writable in each network namespace, and net sysctl permissions allow a task with CAP_NET_ADMIN in the namespace's owning user namespace to write it. An unprivileged user can therefore create a user and network namespace, set tcp_child_ehash_entries to its maximum value, and repeatedly create nested network namespaces to force large kernel allocations and exhaust host memory. Require CAP_NET_ADMIN in the initial user namespace before accepting writes to tcp_child_ehash_entries. This keeps the tuning knob available to the host administrator while preventing unprivileged user namespaces from using it to drive host-wide memory consumption. Fixes: d1e5e6408b30 ("tcp: Introduce optional per-netns ehash.") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Assisted-by: Codex:gpt-5.4 Signed-off-by: Zhiling Zou Signed-off-by: Ren Wei --- net/ipv4/sysctl_net_ipv4.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index ca1180dba1de..1cad1b5cb826 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -415,6 +416,16 @@ static int proc_tcp_ehash_entries(const struct ctl_table *table, int write, return proc_dointvec(&tbl, write, buffer, lenp, ppos); } +static int proc_tcp_child_ehash_entries(const struct ctl_table *table, int write, + void *buffer, size_t *lenp, + loff_t *ppos) +{ + if (write && !capable(CAP_NET_ADMIN)) + return -EPERM; + + return proc_douintvec_minmax(table, write, buffer, lenp, ppos); +} + static int proc_udp_hash_entries(const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { @@ -1524,7 +1535,7 @@ static struct ctl_table ipv4_net_table[] = { .data = &init_net.ipv4.sysctl_tcp_child_ehash_entries, .maxlen = sizeof(unsigned int), .mode = 0644, - .proc_handler = proc_douintvec_minmax, + .proc_handler = proc_tcp_child_ehash_entries, .extra1 = SYSCTL_ZERO, .extra2 = &tcp_child_ehash_entries_max, }, -- 2.43.0