CVE-2026-97476: rds: filter RDS_INFO_* getsockopt by caller's netns

In the Linux kernel, the following vulnerability has been resolved:

rds: filter RDSINFO getsockopt by caller's netns

The RDSINFO family of getsockopt(2) options reads several file-scope global lists that are not per-netns:

rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo -> rdssocklist rdstcptcinfo / rds6tcptcinfo -> rdstcptclist rdsconninfo / rds6conninfo, rdsconnmessageinfocmn (for the SENDMESSAGES and RETRANSMESSAGES variants), rdsforeachconninfo (for RDSINFOIBCONNECTIONS) -> rdsconnhash[]

The handlers do not filter by the caller's network namespace. rdsinfogetsockopt() has no netns or capable() check, and rdscreate() has no capable() check, so AFRDS is reachable from an unprivileged user namespace. As a result, an unprivileged caller in a fresh userns plus netns can read the bound address and sock inode of every RDS socket on the host, the peer address of incoming messages on every RDS socket on the host, the peer address and TCP sequence numbers of every rds-tcp connection on the host, and the peer address and RDS sequence numbers of every RDS connection on the host.

The rds-tcp transport is reachable from a non-initial netns (see rdssettransport()), so a one-shot initnet gate at rdsinfogetsockopt() would deny legitimate per-netns visibility to rds-tcp callers. Instead, filter at each handler by comparing the netns of the caller's socket to the netns of the list entry, or to rdsconnnet(conn) for connection paths. Only copy entries whose netns matches the caller. Counters (RDSINFOCOUNTERS) are aggregate statistics and remain global.

Reproducer (KASAN VM, rds and rdstcp loaded): an AFRDS socket binds 127.0.0.1:4242 in initnet as root. A child process enters a fresh userns plus netns and opens AFRDS there, then calls getsockopt(SOLRDS, RDSINFOSOCKETS). Before this change, the child sees the initnet socket. After this change, the child sees zero entries.

Drop the rdssockcount, rdstcptccount, and rds6tcptccount globals. v2 used them for the size precheck and lens->nr; v3 replaced the precheck with a per-ns count from a first pass over the list, so the globals have no remaining readers. The matching increments and decrements in rdscreate()/rdsdestroysock() and rdstcpsetcallbacks()/rdstcprestorecallbacks() go away with them. Reported by the kernel test robot under clang W=1.