On Mon, Feb 23, 2026 at 06:32:18PM +0100, Greg Kroah-Hartman wrote:
> current->nsproxy is should not be accessed directly as syzbot has found
> that it could be NULL at times, causing crashes. Fix up the af_vsock
> sysctl handlers to use container_of() to deal with the current net
> namespace instead of attempting to rely on current.
>
> This is the same type of change done in commit 7f5611cbc487 ("rds:
> sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy")
>
> Cc: Stefano Garzarella <[email protected]>
> Cc: stable <[email protected]>
> Assisted-by: gkh_clanker_2000
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> ---
>
> Note, this is compile-tested only. Some of my scripts found this when
> looking for places that are missing fixes that were applied to other
> parts of the kernel. I think the af_vsock code uses namespaces, but as
> I don't know the network stack at all I figured I would let you all
> review it to tell me how wrong I got this change and all is fine with
> the original code.
>
> thanks,
>
> greg k-h
>
> net/vmw_vsock/af_vsock.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 9880756d9eff..f4062c6a1944 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -2825,7 +2825,7 @@ static int vsock_net_mode_string(const struct ctl_table
> *table, int write,
> if (write)
> return -EPERM;
>
> - net = current->nsproxy->net_ns;
> + net = container_of(table->data, struct net, vsock.mode);
>
> return __vsock_net_mode_string(table, write, buffer, lenp, ppos,
> vsock_net_mode(net), NULL);
> @@ -2838,7 +2838,7 @@ static int vsock_net_child_mode_string(const struct
> ctl_table *table, int write,
> struct net *net;
> int ret;
>
> - net = current->nsproxy->net_ns;
> + net = container_of(table->data, struct net, vsock.child_ns_mode);
>
> ret = __vsock_net_mode_string(table, write, buffer, lenp, ppos,
> vsock_net_child_mode(net), &new_mode);
> --
> 2.53.0
>
Thanks Greg. LGTM, and passed all tests on my test setup.
I can't say if nsproxy can be null here in particular but better safe
than sorry.
Reviewed-by: Bobby Eshleman <[email protected]>
