From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 81198380FC9 for ; Fri, 12 Jun 2026 09:00:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781254813; cv=none; b=bFkhSVNsdYh4Pwtt4X2l+be62RQ3Gvd78n5bClhaTGeMRfVZF/Ef29zo5BHM3OhgSMIcicsDoKkFm2THtJo+ihWFzkRz0WyomSKtEu4xKyoCJhzODEXKq9iCXo/8JXoiWNKl3RycprC/WiO/hQAhJA7zjBWOvyOdBI5unb9tAPA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781254813; c=relaxed/simple; bh=rGPF2wY1k3BAkSjSLw+YNJLWFe1bXipRPIKGXN0WZ9c=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=lmPh85IVVC/6GdUuOEWchzUN4gmBcu5IbXLDmwc8CCHLztjQRADKEXHenSe/Jz84/NMajH9y/id/D2BbCl4/NpYSoKfibTQBQD6XIDbVMHKUL33TwUROPxEtEuEBpmPC7FHVqMBTH+UnD8rS8/MBkj1BXLVjKmk3+wN6UXewjS8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EAhdhaF9; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EAhdhaF9" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-842358aaf36so329233b3a.2 for ; Fri, 12 Jun 2026 02:00:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781254812; x=1781859612; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=r/VmWPOMWT1TArRP1kFHQW8HKFH/Pq0Or4cO7drGpLY=; b=EAhdhaF9naxkfNVjaD7HAYXnAI4fOP70ucnGVHeynkPVaXG6VFXzm71Pprckwy61NN pAsCUVPFvrVlz6H5RCEZ8HENCxN7Qo0oEd5gLyIA30qRlEcMvKW2T+r7dXhYurQ3VrnV jiuJi7j6utwzNQPSpQjGMmDzzwL2NYlnGF4n333BqcMA/uY/za6FxXpRcUDByyFdWq0T epTJQNtvDzPllET02Wr876hPmz1iFWNSrP7K4q8mEg+P0KiZSiQmDAQw0SA+vft+vZdo wVW+gVmIph1OriQsTqmZyxlVRPjHbUy2hOqlk5VSjL2EEBFYPwzl8l2u5Yh2jToPxZOy 4e3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781254812; x=1781859612; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=r/VmWPOMWT1TArRP1kFHQW8HKFH/Pq0Or4cO7drGpLY=; b=Wa9HHZIlVhyAJlX2fruD+6rxE6q5HQmKFpvfkJEluelsUnkdqMjlKbokRxQpgs4emb 5wblFnq1kOOvSDl9xOOx8t8bSxOeN+dhCS3xIiIdrLPjmIOUar0c0vnM6yy2YTyaSmiF tZ5paqhGX8oQJoMgshJSdxejwYqZCNL2/CA0qwZXA3nGwiEoJOTOOZAma0l9bX7VrIE+ TPDPLZAf+tkjjwNfpqmiFQpXTH/YvvuSpeW7nvJaTCEQRw0z3SpE/lwuR5GwGTW6eCAg wi/m69hpQ8qj2w1nEnpkhVElQlLKivX2YbV44yoa3R/95LOOMjhp1+bQT9YkoJq5t0eW onzg== X-Forwarded-Encrypted: i=1; AFNElJ/I+GFCc5mvE6i0n1DrGOwaGVCVQdWRpNuVbkbXUVVLEnUjJ4ImM5lzXUACaKMPz1qfumSovn2J4oSY91o=@vger.kernel.org X-Gm-Message-State: AOJu0Yx9mw8RQAfuhudsOM17CWYjrYGcjbxcIaWcEhVr/1rpDIH1zbs2 tQ1lrG+eFNMzQlBZAX4aVtNga08PK5cqNllX5nqGhtHQxNFEzqTCwIwn X-Gm-Gg: Acq92OFk8U+iBhqs6tbI/inFM69vfEFkaoAn2Ma7WEvgH7YF/BkA5Tg2mleo5XerkyD cFvvZCv++x12bctb5BXw9CRp4IKSs9YZ9unvP4INfjD7YsKRHkzhhna/Iv6dgq7pQTt7IChZlFk PdPhBvq4cGH2+mYFsas/LYON2nKjfDJqVGZwpe0WYvohrpH5+RosqXkYwNNkYRqjrqnTxVTfCvG YtRayc1R/m9eGAhPRvBsoEk7MUJc2FkWkg9rDEwZ2rNE3EBzU7dpSVKPPrjLmV8lEW3c1TNtuCO cJOLFqsQnUGX5koDhHnCC/Gt9F+mkQJ2MUKD4bjP6sqXI/MWcviRxislLpfzJ2YwcmPmUbtg4L1 5s/5w6WkMKW/ae2zNclwny1AF2wsnJdCSbtWTVT0exW5+wQM+oSLT7tiu/05NJIR5pGbRO3SfPw 3cN25teDvAB9bxoOJVZUkXQad2RrzbtvIZD1UafTkS/cEGNcWM X-Received: by 2002:a05:6a00:84a:b0:82f:2b0:2809 with SMTP id d2e1a72fcca58-8434cadf0famr2119790b3a.1.1781254808571; Fri, 12 Jun 2026 02:00:08 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434a934a97sm1646892b3a.0.2026.06.12.02.00.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Jun 2026 02:00:08 -0700 (PDT) From: Maoyi Xie To: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: David Ahern , Steffen Klassert , Herbert Xu , Simon Horman , Kuniyuki Iwashima , Xiao Liang , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Maoyi Xie Subject: [PATCH net v6 6/7] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Date: Fri, 12 Jun 2026 16:59:40 +0800 Message-Id: <20260612085941.3158249-7-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260612085941.3158249-1-maoyixie.tju@gmail.com> References: <20260612085941.3158249-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed. Reported-by: Xiao Liang Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ Fixes: 61220ab34948 ("vti6: Enable namespace changing") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie Reviewed-by: Kuniyuki Iwashima --- net/ipv6/ip6_vti.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index d871cab6938d..ab94b3a4ba9c 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -1046,6 +1046,9 @@ static int vti6_changelink(struct net_device *dev, struct nlattr *tb[], struct __ip6_tnl_parm p; struct vti6_net *ip6n; + if (!rtnl_dev_link_net_capable(dev, net)) + return -EPERM; + ip6n = net_generic(net, vti6_net_id); if (dev == ip6n->fb_tnl_dev) return -EINVAL; -- 2.34.1