From: Zhiling Zou <redacted>

tcp_child_ehash_entries controls the size of the private TCP established
hash table allocated for subsequently created child network namespaces.
The value is consumed during child netns creation by tcp_set_hashinfo()
and passed to inet_pernet_hashinfo_alloc(), which can allocate a large
per-netns ehash.

The sysctl is writable in each network namespace, and net sysctl
permissions allow a task with CAP_NET_ADMIN in the namespace's owning
user namespace to write it.  An unprivileged user can therefore create a
user and network namespace, set tcp_child_ehash_entries to its maximum
value, and repeatedly create nested network namespaces to force large
kernel allocations and exhaust host memory.

Require CAP_NET_ADMIN in the initial user namespace before accepting
writes to tcp_child_ehash_entries.  This keeps the tuning knob available
to the host administrator while preventing unprivileged user namespaces
from using it to drive host-wide memory consumption.

Fixes: d1e5e6408b30 ("tcp: Introduce optional per-netns ehash.")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <redacted>
Reported-by: Yifan Wu <redacted>
Reported-by: Juefei Pu <redacted>
Reported-by: Xin Liu <redacted>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/ipv4/sysctl_net_ipv4.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index ca1180dba1de..1cad1b5cb826 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c

@@ -9,6 +9,7 @@
 #include <linux/sysctl.h>
 #include <linux/seqlock.h>
 #include <linux/init.h>
+#include <linux/capability.h>
 #include <linux/slab.h>
 #include <net/icmp.h>
 #include <net/ip.h>

@@ -415,6 +416,16 @@ static int proc_tcp_ehash_entries(const struct ctl_table *table, int write,
 	return proc_dointvec(&tbl, write, buffer, lenp, ppos);
 }
 
+static int proc_tcp_child_ehash_entries(const struct ctl_table *table, int write,
+					void *buffer, size_t *lenp,
+					loff_t *ppos)
+{
+	if (write && !capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	return proc_douintvec_minmax(table, write, buffer, lenp, ppos);
+}
+
 static int proc_udp_hash_entries(const struct ctl_table *table, int write,
 				 void *buffer, size_t *lenp, loff_t *ppos)
 {

@@ -1524,7 +1535,7 @@ static struct ctl_table ipv4_net_table[] = {
 		.data		= &init_net.ipv4.sysctl_tcp_child_ehash_entries,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
-		.proc_handler	= proc_douintvec_minmax,
+		.proc_handler	= proc_tcp_child_ehash_entries,
 		.extra1		= SYSCTL_ZERO,
 		.extra2		= &tcp_child_ehash_entries_max,
 	},

-- 
2.43.0