Eric Dumazet 8d650cdeda tcp: fix tcp_set_congestion_control() use from bpf hook
Neal reported incorrect use of ns_capable() from bpf hook.

bpf_setsockopt(...TCP_CONGESTION...)
  -> tcp_set_congestion_control()
   -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)
    -> ns_capable_common()
     -> current_cred()
      -> rcu_dereference_protected(current->cred, 1)

Accessing 'current' in bpf context makes no sense, since packets
are processed from softirq context.

As Neal stated : The capability check in tcp_set_congestion_control()
was written assuming a system call context, and then was reused from
a BPF call site.

The fix is to add a new parameter to tcp_set_congestion_control(),
so that the ns_capable() call is only performed under the right
context.

Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Lawrence Brakmo <brakmo@fb.com>
Reported-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-18 20:33:48 -07:00
..
2019-07-09 12:11:59 -07:00
2019-01-23 11:18:00 -08:00
2019-04-19 14:07:40 -07:00
2019-06-14 20:20:07 -07:00
2018-09-13 09:04:58 -07:00
2017-11-08 16:12:33 +09:00
2018-09-25 20:17:35 -07:00
2017-12-05 14:37:13 -05:00
2018-05-16 07:23:35 +02:00
2019-04-22 21:47:25 -07:00
2019-07-08 19:25:19 -07:00
2019-05-31 08:34:32 -07:00
2019-06-19 11:23:13 -04:00
2019-06-19 11:23:13 -04:00