Re: [PATCH net v4] rtnetlink: add missing netlink_ns_capable() check for peer netns

[Jakub Kicinski <kuba@kernel.org>]

On Sat, 28 Mar 2026 22:33:38 +0100 Nikolaos Gkarlis wrote:
> -static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
> +static struct net *rtnl_get_peer_net(struct sk_buff *skb,
> +				     const struct rtnl_link_ops *ops,
>  				     struct nlattr *tbp[],
>  				     struct nlattr *data[],
>  				     struct netlink_ext_ack *extack)
>  {
>  	struct nlattr *tb[IFLA_MAX + 1];
> +	struct net *net;
>  	int err;
>  
>  	if (!data || !data[ops->peer_type])

There's an early return hiding outside of the context here.
the patch is technically correct, I think, because if we take this
shortcut we end up with the same netns as tgt_net so we'll validate
that it's capable later. But it's probably not obvious to a casual
reader of this code (or AI agents, sigh)

So let's rewrite this along the lines of:

        struct nlattr *tb[IFLA_MAX + 1], **attrs;
        struct net *net;
        int err;
 
        if (!data || !data[ops->peer_type]) {
               attrs = tbp;
	} else {
        	err = rtnl_nla_parse_ifinfomsg(tb, data[ops->peer_type], extack);
	        if (err < 0)
        	        return ERR_PTR(err);
 
	        if (ops->validate) {
        	        err = ops->validate(tb, NULL, extack);
                	if (err < 0)
	                        return ERR_PTR(err);
        	}
 
		attrs = tb;
	}

        net = rtnl_link_get_net_ifla(attrs);
        if (IS_ERR_OR_NULL(net))
                return net;
 
        if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
...

?

> @@ -3915,7 +3917,16 @@ static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
>  			return ERR_PTR(err);
>  	}
>  
> -	return rtnl_link_get_net_ifla(tb);
> +	net = rtnl_link_get_net_ifla(tb);
> +	if (IS_ERR_OR_NULL(net))
> +		return net;
> +
> +	if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
> +		put_net(net);
> +		return ERR_PTR(-EPERM);
> +	}
> +
> +	return net;