[PATCH net] macvlan: require lower-netns admin for shared port settings

[Doruk Tan Ozturk <doruk@0sec.ai>]

A macvlan device can be moved to a network namespace whose user
namespace does not administer the lower device. The rtnetlink
changelink path checks CAP_NET_ADMIN only in the macvlan device network
namespace. However, IFLA_MACVLAN_BC_QUEUE_LEN and
IFLA_MACVLAN_BC_CUTOFF update macvlan_port fields shared by every
macvlan on the lower device.

A caller can also create a nested macvlan on the moved device.
macvlan_common_newlink() resolves that device to the real lower device
without rechecking access to its network namespace.

Xiang Mei reported that a caller can set the shared broadcast queue
length to U32_MAX from an unprivileged user namespace and grow the host
backlog until OOM under an incoming broadcast flood. A fixed numeric
limit was proposed, but legitimate deployments use queue lengths of
100000 or more.

Require CAP_NET_ADMIN in the lower device network namespace for shared
port changes and nested macvlan creation. Per-device settings remain
available to an administrator of the macvlan device network namespace.
This matches the permission model used by ipvlan.

Found by 0sec automated security-research tooling (https://0sec.ai).

Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Closes: https://lore.kernel.org/r/20260706212556.3199234-1-xmei5@asu.edu
Fixes: d4bff72c8401 ("macvlan: Support for high multicast packet rate")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
 drivers/net/macvlan.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 9a4bc99dbf53b..22f03b206c718 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1483,8 +1483,11 @@ int macvlan_common_newlink(struct net_device *dev,
 	/* When creating macvlans or macvtaps on top of other macvlans - use
 	 * the real device as the lowerdev.
 	 */
-	if (netif_is_macvlan(lowerdev))
+	if (netif_is_macvlan(lowerdev)) {
 		lowerdev = macvlan_dev_real_dev(lowerdev);
+		if (!rtnl_dev_link_net_capable(dev, dev_net(lowerdev)))
+			return -EPERM;
+	}
 
 	if (!tb[IFLA_MTU])
 		dev->mtu = lowerdev->mtu;
@@ -1623,6 +1626,12 @@ static int macvlan_changelink(struct net_device *dev,
 	enum macvlan_macaddr_mode macmode;
 	int ret;
 
+	if (data &&
+	    (data[IFLA_MACVLAN_BC_QUEUE_LEN] ||
+	     data[IFLA_MACVLAN_BC_CUTOFF]) &&
+	    !rtnl_dev_link_net_capable(dev, dev_net(vlan->lowerdev)))
+		return -EPERM;
+
 	/* Validate mode, but don't set yet: setting flags may fail. */
 	if (data && data[IFLA_MACVLAN_MODE]) {
 		set_mode = true;
-- 
2.43.0