From: Gang Yan <yangang@kylinos.cn>
When a BPF program calls bpf_setsockopt(), it may run in softirq
context where ns_capable() is not appropriate as there is no valid
credential context. Use sockopt_ns_capable() instead, which skips
the capability check when invoked from a BPF program.
Fixes: e42c7beee71d ("bpf: net: Consider has_current_bpf_ctx() when testing capable() in sk_setsockopt()")
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
net/mptcp/sockopt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index 552e07296b38..059c386f427b 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -598,7 +598,7 @@ static int mptcp_setsockopt_sol_tcp_congestion(struct mptcp_sock *msk, sockptr_t
name[ret] = 0;
- cap_net_admin = ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN);
+ cap_net_admin = sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN);
ret = 0;
sockopt_lock_sock(sk);
--
2.43.0