Commit dd6f1e7582f0 for kernel

commit dd6f1e7582f0f7f12c2d620cf50446aa987d7327
Author: Zhao Gongyi <zhaogongyi@bytedance.com>
Date:   Wed Nov 11 11:35:25 2026 +0800

    net: netns: fix INT_MAX nsid cleanup

    A syzkaller reproducer assigning INT_MAX as a peer nsid triggers an
    idr_get_next() warning during netns cleanup. With panic_on_warn, this
    panics the kernel.

    alloc_netid() also overflows reqid + 1 for this nsid. Use
    idr_alloc_u32() for requested IDs and idr_get_next_ul() for cleanup so
    the cursor can advance past INT_MAX.

    QEMU/KVM reproduced the warning without kernel changes or fault
    injection. The same reproducer ran without warnings after this change.
    Kernel selftests were not run.

    Fixes: 7acee67a6bce ("netns: optimize netns cleaning by batching unhash_nsid calls")
    Cc: stable@vger.kernel.org
    Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>
    Link: https://patch.msgid.link/20261111033525.65828-1-zhaogongyi@bytedance.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 52c2bd44778a..c94718429771 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -270,14 +270,19 @@ static void ops_undo_single(struct pernet_operations *ops,
 /* should be called with nsid_lock held */
 static int alloc_netid(struct net *net, struct net *peer, int reqid)
 {
-	int min = 0, max = 0;
+	int ret;
+	u32 id;

 	if (reqid >= 0) {
-		min = reqid;
-		max = reqid + 1;
+		id = reqid;
+		ret = idr_alloc_u32(&net->netns_ids, peer, &id, id,
+				    GFP_ATOMIC);
+		if (ret)
+			return ret;
+		return id;
 	}

-	return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
+	return idr_alloc(&net->netns_ids, peer, 0, 0, GFP_ATOMIC);
 }

 /* This function is used by idr_for_each(). If net is equal to peer, the
@@ -639,10 +644,10 @@ static void unhash_nsid(struct net *last)
 	 * use for_each_net_rcu() or net_rwsem.
 	 */
 	for_each_net(tmp) {
-		int id = 0;
+		unsigned long id = 0;

 		spin_lock(&tmp->nsid_lock);
-		while ((peer = idr_get_next(&tmp->netns_ids, &id))) {
+		while ((peer = idr_get_next_ul(&tmp->netns_ids, &id))) {
 			int curr_id = id;

 			id++;