From: Kuniyuki Iwashima <kuniyu@google.com>
To: nickgarlis@gmail.com
Cc: kuba@kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH] rtnetlink: add missing netlink_ns_capable() check for peer netns
Date: Fri, 27 Mar 2026 16:03:50 +0000 [thread overview]
Message-ID: <20260327160540.3392203-1-kuniyu@google.com> (raw)
In-Reply-To: <CA+jwDRk_pg6jLsg_nZ+DwHKcLk-TjbhS5o8aveOD5ns=yxUYCg@mail.gmail.com>
From: Nikolaos Gkarlis <nickgarlis@gmail.com>
Date: Fri, 27 Mar 2026 09:55:31 +0100
> Hi Jakub,
>
> I've created a crude reproduction script using some AI. If that helps,
> you can find it here:
> https://gist.githubusercontent.com/nickgarlis/5a5815d438aa19b409806712f35f2cb1/raw/c7e2dd0902f1f53f5750f7bbd3ba39ff0b21e43e/inject_iface.c
>
> > AI assistant here suggests this is not the valid Fixes tag,
> > which seems true on the surface. This commit was fixing
> > cleanup, IDK how it could break input validation?
>
> I went back to check and ran the test against 7a0ea70da56e (the commit
> prior) and it does seem like it was broken then too. I think I must have
> messed up my testing process when I initially submitted the patch.
>
> It also seems like the bug was always there or at least - almost always
> - since Iassume it wasn't a problem before unprivileged namespaces
> were introduced ?
>
> In that case, should the tags point to the introduction of the
> attributes (like shown below) or point to the introduction of
> the namespaces ?
>
> Fixes: 0eb87b02a705 ("veth: Set VETH_INFO_PEER to veth_link_ops.peer_type.")
> Fixes: 6b84e558e95d ("vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type.")
> Fixes: fefd5d082172 ("netkit: Set IFLA_NETKIT_PEER_INFO to
> netkit_link_ops.peer_type.")
No, these commits just factorised the common part.
veth does not have the userns check from
commit 81adee47dfb608df3ad0b91d230fb3cef75f0060
Author: Eric W. Biederman <ebiederm@aristanetworks.com>
Date: Sun Nov 8 08:53:51 2009
net: Support specifying the network namespace upon device creation.
and vxcan and netkit does not have the check from Day 0.
prev parent reply other threads:[~2026-03-27 16:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 8:07 [PATCH] rtnetlink: add missing netlink_ns_capable() check for peer netns Nikolaos Gkarlis
2026-03-27 3:36 ` Jakub Kicinski
2026-03-27 8:55 ` Nikolaos Gkarlis
2026-03-27 16:03 ` Kuniyuki Iwashima [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260327160540.3392203-1-kuniyu@google.com \
--to=kuniyu@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nickgarlis@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox