Re: [PATCH net v3 1/1] ipv6: flowlabel: cap duplicate leases per socket

[Ido Schimmel <idosch@nvidia.com>]

On Sat, Aug 22, 2026 at 04:41:42PM +0800, ZhilingZouzhilinz@nebusec.ai wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every
> successful GET. The recheck path for a compatible existing flowlabel
> links another lease without applying any lease admission check. Repeated
> GET requests for one shareable label can therefore grow a socket's lease
> list without bound.
> 
> Count the socket's existing leases during the lookup and reject a new
> unprivileged lease once the count reaches FL_MAX_PER_SOCK. This matches
> mem_check()'s per-socket accounting and also covers leases acquired from
> distinct globally interned labels. The IPv6 sockopt lock serializes the
> count with fl_link() and PUT, so no global ip6_fl_lock is needed.
> 
> Check CAP_NET_ADMIN only when the socket reaches the limit. This avoids a
> capability audit on successful unprivileged GET requests below the cap,
> while privileged callers remain unrestricted.
> 
> Do the admission check before updating linger and expires. A rejected GET
> does not refresh the shared label, matching the existing socket-list
> allocation failure path.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
> changes in v3:
> - Count the socket's full lease list instead of only matching leases.
> - Defer the CAP_NET_ADMIN check until the lease count reaches the limit.
> - v2 Link: https://lore.kernel.org/all/528bc30d301bcf32aca37cda1933b617d2d295f4.1786447968.git.zhilinz@nebusec.ai/
> 
> changes in v2:
> - Count only leases of the flowlabel being reused.
> - Fold the count into the existing socket-list lookup.
> - Keep new-label admission under the existing mem_check() policy.
> - Stop after the first matching lease for CAP_NET_ADMIN callers.
> - Explain why a rejected GET does not refresh linger or expires.
> - Correct the reuse-path explanation and trim the Fixes hash.
> - v1 Link: https://lore.kernel.org/all/cf4fdc79ae4dc46bd4eb7eeb57e5de2091c13cd3.1785746178.git.zhilinz@nebusec.ai/
> 
>  net/ipv6/ip6_flowlabel.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
> index 1ab5ad0dcf24f..b864dfc87f779 100644
> --- a/net/ipv6/ip6_flowlabel.c
> +++ b/net/ipv6/ip6_flowlabel.c
> @@ -617,6 +617,7 @@ static int ipv6_flowlabel_get(struct sock *sk, struct in6_flowlabel_req *freq,
>  	struct ipv6_fl_socklist *sfl, *sfl1 = NULL;
>  	struct ip6_flowlabel *fl, *fl1 = NULL;
>  	struct net *net = sock_net(sk);
> +	int lease_count = 0;
>  	int err;
>  
>  	if (freq->flr_flags & IPV6_FL_F_REFLECT) {
> @@ -647,16 +648,20 @@ static int ipv6_flowlabel_get(struct sock *sk, struct in6_flowlabel_req *freq,
>  		err = -EEXIST;
>  		rcu_read_lock();
>  		for_each_sk_fl_rcu(sk, sfl) {
> +			lease_count++;
>  			if (sfl->fl->label == freq->flr_label) {
>  				if (freq->flr_flags & IPV6_FL_F_EXCL) {
>  					rcu_read_unlock();
>  					goto done;
>  				}
> -				fl1 = sfl->fl;
> -				if (!atomic_inc_not_zero(&fl1->users))
> -					fl1 = NULL;
> -				break;
> +				if (!fl1) {
> +					fl1 = sfl->fl;
> +					if (!atomic_inc_not_zero(&fl1->users))
> +						fl1 = NULL;
> +				}
>  			}
> +			if (fl1 && lease_count >= FL_MAX_PER_SOCK)
> +				break;

I find this hunk confusing. What do we gain from it? Unpriv users can
still walk the entire list in case of a miss. Also, we can get to the
recheck label from the fl_intern() path which is outside of this block.
How about something like [1]?

Also, please mention in the commit message that capable() is used
instead of ns_capable() in order to be consistent with mem_check() and
because we want to prevent unpriv users from consuming the host's memory
by creating a user ns and a netns where they have CAP_NET_ADMIN.

>  		}
>  		rcu_read_unlock();
>  
> @@ -679,6 +684,11 @@ static int ipv6_flowlabel_get(struct sock *sk, struct in6_flowlabel_req *freq,
>  			err = -ENOMEM;
>  			if (!sfl1)
>  				goto release;
> +			/* sockopt_lock_sock() serializes the count and fl_link(). */
> +			err = -ENOBUFS;
> +			if (lease_count >= FL_MAX_PER_SOCK &&
> +			    !capable(CAP_NET_ADMIN))
> +				goto release;
>  			if (fl->linger > fl1->linger)
>  				fl1->linger = fl->linger;
>  			if ((long)(fl->expires - fl1->expires) > 0)

[1]
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1ab5ad0dcf24..006585dc8b5c 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -461,6 +461,21 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
 	return NULL;
 }
 
+static bool fl_sock_at_lease_limit(const struct sock *sk)
+{
+	const struct ipv6_fl_socklist *sfl;
+	int count = 0;
+
+	rcu_read_lock();
+	for_each_sk_fl_rcu(sk, sfl) {
+		if (++count >= FL_MAX_PER_SOCK)
+			break;
+	}
+	rcu_read_unlock();
+
+	return count >= FL_MAX_PER_SOCK;
+}
+
 static int mem_check(struct sock *sk)
 {
 	const int unpriv_total_limit = FL_MAX_SIZE - (FL_MAX_SIZE / 4);
@@ -679,6 +694,10 @@ static int ipv6_flowlabel_get(struct sock *sk, struct in6_flowlabel_req *freq,
 			err = -ENOMEM;
 			if (!sfl1)
 				goto release;
+			err = -ENOBUFS;
+			if (fl_sock_at_lease_limit(sk) &&
+			    !capable(CAP_NET_ADMIN))
+				goto release;
 			if (fl->linger > fl1->linger)
 				fl1->linger = fl->linger;
 			if ((long)(fl->expires - fl1->expires) > 0)