From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D798D4A1383 for ; Tue, 9 Jun 2026 16:31:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781022702; cv=none; b=JPGrvBMuZxNWupEjIJy0aEGFEfdZogr/E/cZ3az8k7bO2fvICC+wii1E3MeWrKQFQfLlzn1l7eiYHnx0werKwvi65ecC+6uYUtXVAwbSPibWPt9FfD/92AaLKdJ6c6pmRcR5uyYMc6G+0P2OTUPMbHxdn5pAgGcF/2A6UyXFlmk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781022702; c=relaxed/simple; bh=964slByQ2g57y1gfeoWWO0abKPXFuUrmXKARDVr3EQI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ts4tki3eYOPUiWiA5C8Tys2Gi9xjrKOBkazQKGXR6bNjEKOweEsyW7abURoABmknjt3QukMELz+aZ2XW56w83PnnP85MoBbZCQM1X3KUMtBSAXNVnv+GF8gFRg8O+kkiYlpH24BSEozCp5NTIKWtrlpPi33EIOAmnbiUbQjI6lk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ksWFifbg; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ksWFifbg" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c8573e75425so2198086a12.2 for ; Tue, 09 Jun 2026 09:31:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781022700; x=1781627500; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=etjlWY0ED/lfXMUZNVvEX8hp93y3gVFfFSFVc3VEUY8=; b=ksWFifbgukn948JGak0w1XMZtmuyXzfLOV8eHxKB2py8aOONDgqi5GTsyQm57wBlPY eDG0uOpLpBZ9BFvgu4aY1inAYsoc410sTFRW5xXnMAD9EZvHpq+65UqF/mGDL4qST6XF RmE+ufukXusQjq7Tnthyrml1uExotzoC3SsFmyB61IoFYINfdDwCkFaM3TVClgdf7x19 W8VgDy6NX1u+XZvbBdNWcXe0fDWQZrnJZ1e5/fGS3Tib88Pp2Cu3NmKj6PcySEdcB0LN /CZB91hZy71rNAdHumW1X+eJDhS9H1kftJfr5LpnU/bFyEL3SV6Aix7WA57z0Y5RrDqw 9hmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781022700; x=1781627500; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=etjlWY0ED/lfXMUZNVvEX8hp93y3gVFfFSFVc3VEUY8=; b=sFvq2Io11D/qFZDoUdtxC95LEtHC6Eb8o4bKtXzVdeYFD47513+GUle+bLQoocixOe GPCB4Zaf6AMhwvzqpCJuozwdo21Q4CZouitZ6AkChDysam/RGtxSovBqVv5JX1KxWyNa DrWC6Rc7H4hcacWVTvioJjgA2ck8F71HjwjGUyWZaDmZtIU113K6T/1FbBX/KWKRu/fa 7iH9aME08v4UxDiHIWigGfvq5GDhOzNwdB3vIuo9BNL1x+CY/navy6zg7/hj/hNxW58b /R8gzlGkQxXVX10H6h5Hvvqc9fchB1G3CoHSKgt04iogRZj3VeF7zutVGVh2AHEcnGy8 K5vw== X-Forwarded-Encrypted: i=1; AFNElJ/mBYL8DTiXruH4DCsuZWdtj34bxKpuX8xFYGEOKvoeozQAS9BurUQh3bLaw3wZPPpYZWKd6bsC/kt14L0=@vger.kernel.org X-Gm-Message-State: AOJu0Yye4BofG8h/QQbYN+wsrQff/X4G2I+4Rd17PppkFcMYYsSLrx2p Ke0EzN6GyAVE1WRw/dN4rAFdAMd6Qg8GFo4fhc8SiF22d3IudJ7SHSFe X-Gm-Gg: Acq92OGcGAPooP5dyB/i8itFD3EnKNaEAT/MchMEnWTTMmvUuDwXGMob9yxJF34qroh 9IUh1WCUpQSF2O0GeIc32hNiJSgZprWGcq82KV7xwm3RPcfmCmS4h3Cd5Dj5VmfE4of7sOzvZgF iNbmetiZwy7pJSS2GdnUrdLlPV9FzXkj9NiVH9o6Or+bHMMESrnOcAVmArCBSyIzghj5vBcUzMT NLALqWUBbq/Nmm9aAAhfQZHUYJQ8j/deru5mpEl7ceIedImhe8KC94r2tFVmegEAZaDW4Tih0xc 8ViNK8xDnBjMEaU1xd0v5prt8waL4vI3eJAzLpXSjoTLuewqwatg+oc8Ca4zbHVeMzINEuYyCMs /Kql9Kps6LdX+h3bpb1O6QAEyMGDQ+UeNynneqduGZvEudoAXu3X0L9XycPNYU9a9v99Ue9nlKA ayq/FSu/JMVg/3HPBbK8xMxYn4P2taaaIP6YFE4WegzZc3GZm6rU0No9xJPK4= X-Received: by 2002:a17:903:38d0:b0:2bd:ba75:81c4 with SMTP id d9443c01a7336-2c1e7b150a9mr267590715ad.13.1781022700012; Tue, 09 Jun 2026 09:31:40 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16629d042sm227710195ad.60.2026.06.09.09.31.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 09:31:39 -0700 (PDT) From: Maoyi Xie To: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: David Ahern , Kuniyuki Iwashima , Xiao Liang , Steffen Klassert , Herbert Xu , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v4 6/7] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Date: Wed, 10 Jun 2026 00:31:09 +0800 Message-Id: <20260609163110.1717419-7-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260609163110.1717419-1-maoyixie.tju@gmail.com> References: <20260609163110.1717419-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vti6_changelink() rewrites the tunnel in its creation netns. After an IFLA_NET_NS_FD migration that netns is not the caller's, but the rtnl changelink path only checks CAP_NET_ADMIN against the caller's netns. A caller with caps only in its current netns can then rewrite a tunnel in another netns and pick its endpoint addresses. Gate the op on net_admin_capable() at its top, before any attribute is parsed. The check is skipped when the tunnel netns is the device's current netns, where the rtnl path already checked the cap. Reported-by: Xiao Liang Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ Fixes: 11b326fb0a37 ("ip6: vti: Use ip6_tnl.net in vti6_changelink().") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie --- net/ipv6/ip6_vti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index df793c8bfffb..ec82626363f7 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -1044,6 +1044,9 @@ static int vti6_changelink(struct net_device *dev, struct nlattr *tb[], struct __ip6_tnl_parm p; struct vti6_net *ip6n; + if (!net_admin_capable(net, dev_net(dev))) + return -EPERM; + ip6n = net_generic(net, vti6_net_id); if (dev == ip6n->fb_tnl_dev) return -EINVAL; -- 2.34.1