On Thu, Jul 18, 2019 at 10:28 PM Eric Dumazet <[email protected]> wrote: > > Neal reported incorrect use of ns_capable() from bpf hook. > > bpf_setsockopt(...TCP_CONGESTION...) > -> tcp_set_congestion_control() > -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN) > -> ns_capable_common() > -> current_cred() > -> rcu_dereference_protected(current->cred, 1) > > Accessing 'current' in bpf context makes no sense, since packets > are processed from softirq context. > > As Neal stated : The capability check in tcp_set_congestion_control() > was written assuming a system call context, and then was reused from > a BPF call site. > > The fix is to add a new parameter to tcp_set_congestion_control(), > so that the ns_capable() call is only performed under the right > context. > > Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control") > Signed-off-by: Eric Dumazet <[email protected]> > Cc: Lawrence Brakmo <[email protected]> > Reported-by: Neal Cardwell <[email protected]> > ---
Acked-by: Neal Cardwell <[email protected]> Thanks, Eric! neal
