Re: [PATCH net v4 1/1] ipv6: flowlabel: cap duplicate leases per socket

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Sep 03, 2026 at 02:23:03PM +0800, Zhiling Zou wrote:
> ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every
> successful GET. The recheck path for a compatible existing flowlabel
> links another lease without applying any lease admission check. Repeated
> GET requests for one shareable label can therefore grow a socket's lease
> list without bound.
> 
> Reject a new unprivileged lease once the socket already holds
> FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse
> of a globally interned label, including the fl_intern() collision path,
> is covered as well. New-label admission remains under the existing
> mem_check() policy.
> 
> Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching
> mem_check(). An unprivileged user must not bypass the cap by creating a
> user namespace and a netns where they have CAP_NET_ADMIN, which would
> still consume host memory.
> 
> Check the capability only when the socket reaches the limit, so
> successful unprivileged GET requests below the cap do not generate a
> capability audit. Do the admission check before updating linger and
> expires so a rejected GET does not refresh the shared label, matching
> the existing socket-list allocation failure path.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Suggested-by: Ido Schimmel <idosch@nvidia.com>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>