Re: [PATCH net v2] netlink: avoid hashing the network namespace pointer

[Eric Dumazet]

Le jeu. 8 oct. 2026 à 03:14, Kyle Zeng <kylebot@xxxxxxxxxx> a écrit :
>
> The netlink rhashtable key includes a raw struct net pointer and a
> user-controlled port ID. Both /proc/net/netlink and socket diagnostics
> expose the table's bucket order. By binding and rebinding chosen
> NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
> buckets and recover the low bits of the Jenkins hash. Its 32-bit seed
> and the limited set of kernel-image slides can then be searched offline
> to recover the address of init_net.
>
> Use the namespace's unique, non-address net_cookie in the comparison
> key instead. It is assigned before the per-net initializers run and
> remains unchanged for the namespace's lifetime. The lookup key and
> object hash are still built by netlink_compare_arg_init(), keeping
> lookup, insertion, removal and rehashing consistent while preserving
> namespace separation. Neither public table walker needs to change.
>
> Reading the socket's namespace cookie in netlink_compare() is safe
> under RCU, including during namespace teardown. netlink_release()
> removes the socket from the hash table and defers its final put with
> call_rcu(). cleanup_net() runs the per-net exit methods and waits for
> outstanding RCU callbacks with rcu_barrier() before freeing namespace
> storage.
>
> Unlike ns.ns_id, net_cookie is also available and initialized during
> setup_net() in older stable kernels, making the change straightforward
> to backport to v5.15 and later.
>
> Fixes: c428ecd1a21f ("netlink: Move namespace into hash key")
> Assisted-by: LLM
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> ---
>
> Changes in v2:
> - Use net_cookie for compatibility with older stable kernels.
> - Name the key field net_cookie to avoid confusion with netns IDs.
> - Explain the RCU lifetime of the socket and network namespace.

Please next time add a Link to the prior version, and/or maybe give
credits to reviewers ideas,
this is something that humans care for.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>