[PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Doruk Tan Ozturk <doruk@0sec.ai>]

The netdev generic-netlink bind-rx operation (NETDEV_CMD_BIND_RX) is
flagged uns-admin-perm, so binding a dmabuf into a device RX datapath
requires CAP_NET_ADMIN. The symmetric bind-tx operation
(NETDEV_CMD_BIND_TX), added later, was given no permission flag. The
netdev family sets netnsok and has no pre_doit, and
netdev_nl_bind_tx_doit() performs no capability check, so any
unprivileged process can bind a dmabuf into a netmem-TX-capable device
TX datapath.

net_devmem_bind_dmabuf() attaches and DMA-maps the caller-supplied
dmabuf to the device and installs TX device-memory state, the same
class of privileged device operation that bind-rx restricts. Gate
bind-tx behind uns-admin-perm to match bind-rx.

Found by 0sec (https://0sec.ai).

Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/netdev.yaml b/Documentation/netlink/specs/netdev.yaml
index 5f143da7458c..6c374aca3d27 100644
--- a/Documentation/netlink/specs/netdev.yaml
+++ b/Documentation/netlink/specs/netdev.yaml
@@ -832,6 +832,7 @@ operations:
       name: bind-tx
       doc: Bind dmabuf to netdev for TX
       attribute-set: dmabuf
+      flags: [uns-admin-perm]
       do:
         request:
           attributes:
diff --git a/net/core/netdev-genl-gen.c b/net/core/netdev-genl-gen.c
index d18c89b5a6c7..07d87445eb22 100644
--- a/net/core/netdev-genl-gen.c
+++ b/net/core/netdev-genl-gen.c
@@ -234,7 +234,7 @@ static const struct genl_split_ops netdev_nl_ops[] = {
 		.doit		= netdev_nl_bind_tx_doit,
 		.policy		= netdev_bind_tx_nl_policy,
 		.maxattr	= NETDEV_A_DMABUF_FD,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= NETDEV_CMD_QUEUE_CREATE,
-- 
2.43.0