On Thu, May 13, 2021 at 04:28:35AM -0400, Jonathon Reinhart wrote:
> commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.
>
> These sysctls point to global variables:
> - [0] "nf_conntrack_max" (&nf_conntrack_max)
> - [2] "nf_conntrack_buckets" (&nf_conntrack_htable_size_user)
> - [5] "nf_conntrack_expect_max" (&nf_ct_expect_max)
>
> Because their data pointers are not updated to point to per-netns
> structures, they must be marked read-only in a non-init_net ns.
> Otherwise, changes in any net namespace are reflected in (leaked into)
> all other net namespaces. This problem has existed since the
> introduction of net namespaces.
>
> This patch is necessarily different from the upstream patch due to the
> heavy refactoring which took place since 4.19:
>
> d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
> b884fa461776 ("netfilter: conntrack: unify sysctl handling")
> 4a65798a9408 ("netfilter: conntrack: add mnemonics for sysctl table")
>
> Signed-off-by: Jonathon Reinhart <jonathon.reinhart@xxxxxxxxx>
> ---
>
> Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
> 5.12 trees.
>
> This was tested on 4.19.190, so please apply to 4.19.y.
>
> It should also apply to:
> - 4.14.y
> - 4.9.y
>
> Note that 5.4.y would require a slightly different patch that looks more
> like 2671fa4dc010.
All now queued up, thanks!
greg k-h
