[PATCH net] netlink: avoid hashing the network namespace pointer

[Kyle Zeng <kylebot@openai.com>]

The netlink rhashtable key includes a raw struct net pointer and a
user-controlled port ID.  Both /proc/net/netlink and socket diagnostics
expose the table's bucket order.  By binding and rebinding chosen
NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
buckets and recover the low bits of the Jenkins hash.  Its 32-bit seed
and the limited set of kernel-image slides can then be searched offline
to recover the address of init_net.

Use the namespace's unique, non-address ID in the comparison key
instead.  This ID is assigned before the per-net initializers run and
remains unchanged for the namespace's lifetime.  The lookup key and
object hash are still built by netlink_compare_arg_init(), keeping
lookup, insertion, removal and rehashing consistent while preserving
namespace separation.  Neither public table walker needs to change.

Fixes: c428ecd1a21f ("netlink: Move namespace into hash key")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/netlink/af_netlink.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9fdf964224ab..e62bb67b78b0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -464,7 +464,7 @@ netlink_unlock_table(void)
 
 struct netlink_compare_arg
 {
-	possible_net_t pnet;
+	u64 netns_id;
 	u32 portid;
 };
 
@@ -479,14 +479,14 @@ static inline int netlink_compare(struct rhashtable_compare_arg *arg,
 	const struct netlink_sock *nlk = ptr;
 
 	return nlk->portid != x->portid ||
-	       !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
+	       sock_net(&nlk->sk)->ns.ns_id != x->netns_id;
 }
 
 static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
 				     struct net *net, u32 portid)
 {
 	memset(arg, 0, sizeof(*arg));
-	write_pnet(&arg->pnet, net);
+	arg->netns_id = net->ns.ns_id;
 	arg->portid = portid;
 }
 

base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab