[PATCH net] netdev: require admin permission for the bind-tx netlink operation

[PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Doruk Tan Ozturk]

The netdev generic-netlink bind-rx operation (NETDEV_CMD_BIND_RX) is
flagged uns-admin-perm, so binding a dmabuf into a device RX datapath
requires CAP_NET_ADMIN. The symmetric bind-tx operation
(NETDEV_CMD_BIND_TX), added later, was given no permission flag. The
netdev family sets netnsok and has no pre_doit, and
netdev_nl_bind_tx_doit() performs no capability check, so any
unprivileged process can bind a dmabuf into a netmem-TX-capable device
TX datapath.

net_devmem_bind_dmabuf() attaches and DMA-maps the caller-supplied
dmabuf to the device and installs TX device-memory state, the same
class of privileged device operation that bind-rx restricts. Gate
bind-tx behind uns-admin-perm to match bind-rx.

Found by 0sec (https://0sec.ai).

Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/netdev.yaml b/Documentation/netlink/specs/netdev.yaml
index 5f143da7458c..6c374aca3d27 100644
--- a/Documentation/netlink/specs/netdev.yaml
+++ b/Documentation/netlink/specs/netdev.yaml
@@ -832,6 +832,7 @@ operations:
       name: bind-tx
       doc: Bind dmabuf to netdev for TX
       attribute-set: dmabuf
+      flags: [uns-admin-perm]
       do:
         request:
           attributes:
diff --git a/net/core/netdev-genl-gen.c b/net/core/netdev-genl-gen.c
index d18c89b5a6c7..07d87445eb22 100644
--- a/net/core/netdev-genl-gen.c
+++ b/net/core/netdev-genl-gen.c
@@ -234,7 +234,7 @@ static const struct genl_split_ops netdev_nl_ops[] = {
 		.doit		= netdev_nl_bind_tx_doit,
 		.policy		= netdev_bind_tx_nl_policy,
 		.maxattr	= NETDEV_A_DMABUF_FD,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= NETDEV_CMD_QUEUE_CREATE,
-- 
2.43.0

Re: [PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Mina Almasry]

On Fri, Jul 24, 2026 at 8:01 AM Doruk Tan Ozturk <doruk@0sec.ai> wrote:
>
> The netdev generic-netlink bind-rx operation (NETDEV_CMD_BIND_RX) is
> flagged uns-admin-perm, so binding a dmabuf into a device RX datapath
> requires CAP_NET_ADMIN. The symmetric bind-tx operation
> (NETDEV_CMD_BIND_TX), added later, was given no permission flag. The
> netdev family sets netnsok and has no pre_doit, and
> netdev_nl_bind_tx_doit() performs no capability check, so any
> unprivileged process can bind a dmabuf into a netmem-TX-capable device
> TX datapath.
>
> net_devmem_bind_dmabuf() attaches and DMA-maps the caller-supplied
> dmabuf to the device and installs TX device-memory state, the same
> class of privileged device operation that bind-rx restricts. Gate
> bind-tx behind uns-admin-perm to match bind-rx.
>
> Found by 0sec (https://0sec.ai).
>
> Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
> Cc: stable@vger.kernel.org
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>


It's intentional that NET_ADMIN is needed for RX but not TX. Maybe add
that to the documentation.

On RX you'll see any received packets on the RX queue, so binding
memory there is sensitive. However binding a dmabuf to a netdev for TX
is not really sensitive. It's the same as sendmsg with zerocopy more
or less.

-- 
Thanks,
Mina

Re: [PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Doruk Tan Ozturk]

> It's intentional that NET_ADMIN is needed for RX but not TX. Maybe add
> that to the documentation.

Thanks, that makes sense: the RX binding exposes other traffic on the
queue, while a TX binding only sends the caller's own memory. Sorry for
the noise. Please drop this patch.

-Doruk

Re: [PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Stanislav Fomichev]

On 07/24, Doruk Tan Ozturk wrote:
> The netdev generic-netlink bind-rx operation (NETDEV_CMD_BIND_RX) is
> flagged uns-admin-perm, so binding a dmabuf into a device RX datapath
> requires CAP_NET_ADMIN. The symmetric bind-tx operation
> (NETDEV_CMD_BIND_TX), added later, was given no permission flag. The
> netdev family sets netnsok and has no pre_doit, and
> netdev_nl_bind_tx_doit() performs no capability check, so any
> unprivileged process can bind a dmabuf into a netmem-TX-capable device
> TX datapath.
> 
> net_devmem_bind_dmabuf() attaches and DMA-maps the caller-supplied
> dmabuf to the device and installs TX device-memory state, the same
> class of privileged device operation that bind-rx restricts. Gate
> bind-tx behind uns-admin-perm to match bind-rx.

TX is permission-less by design, it does not modify the netdev in any way.