FAILED: patch "[PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for" failed to apply to 6.1-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026070221-oblivious-crayfish-1017@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 Mon Sep 17 00:00:00 2001
From: Maoyi Xie <[email protected]>
Date: Fri, 12 Jun 2026 16:59:35 +0800
Subject: [PATCH] net: ip_gre: require CAP_NET_ADMIN in the device netns for
changelink
A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.
Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.
include/net/rtnetlink.h +2 -0
@@ -256,6 +256,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm,int rtnl_nla_parse_ifinfomsg (struct nlattr **tb,const struct nlattr *nla_peer,struct netlink_ext_ack *exterr);struct net *rtnl_get_net_ns_capable (struct sock *sk,int netnsid); +bool rtnl_dev_link_net_capable (const struct net_device *dev, +const struct net *link_net);#define MODULE_ALIAS_RTNL_LINK (kind) MODULE_ALIAS("rtnl-link-" kind)
net/core/rtnetlink.c +8 -0
@@ -2438,6 +2438,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid) }EXPORT_SYMBOL_GPL (rtnl_get_net_ns_capable); +bool rtnl_dev_link_net_capable (const struct net_device *dev, +const struct net *link_net) +{ +return net_eq (link_net,dev_net (dev)) || +ns_capable (link_net->user_ns,CAP_NET_ADMIN ); +} +EXPORT_SYMBOL_GPL (rtnl_dev_link_net_capable); +static int rtnl_valid_dump_ifinfo_req (const struct nlmsghdr *nlh,bool strict_check,struct nlattr **tb,struct netlink_ext_ack *extack)
net/ipv4/ip_gre.c +6 -0
@@ -1457,6 +1457,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],__u32 fwmark = t->fwmark;int err; +if (!rtnl_dev_link_net_capable (dev, t->net)) +return -EPERM ; + err =ipgre_newlink_encap_setup (dev, data);if (err)return err;
@@ -1486,6 +1489,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],__u32 fwmark = t->fwmark;int err; +if (!rtnl_dev_link_net_capable (dev, t->net)) +return -EPERM ; + err =ipgre_newlink_encap_setup (dev, data);if (err)return err;
Sasha Levin
maintainerPATCH 1/1 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
From: Maoyi Xie <[email protected]>
[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]
A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net.
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper.
Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs.
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.
--- include/net/rtnetlink.h | 2 ++ net/core/rtnetlink.c | 8 ++++++++ net/ipv4/ip_gre.c | 6 ++++++ 3 files changed, 16 insertions(+)
include/net/rtnetlink.h +2 -0
@@ -210,6 +210,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm,int rtnl_nla_parse_ifinfomsg (struct nlattr **tb,const struct nlattr *nla_peer,struct netlink_ext_ack *exterr);struct net *rtnl_get_net_ns_capable (struct sock *sk,int netnsid); +bool rtnl_dev_link_net_capable (const struct net_device *dev, +const struct net *link_net);#define MODULE_ALIAS_RTNL_LINK (kind) MODULE_ALIAS("rtnl-link-" kind)
net/core/rtnetlink.c +8 -0
@@ -2110,6 +2110,14 @@ struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid) }EXPORT_SYMBOL_GPL (rtnl_get_net_ns_capable); +bool rtnl_dev_link_net_capable (const struct net_device *dev, +const struct net *link_net) +{ +return net_eq (link_net,dev_net (dev)) || +ns_capable (link_net->user_ns,CAP_NET_ADMIN ); +} +EXPORT_SYMBOL_GPL (rtnl_dev_link_net_capable); +static int rtnl_valid_dump_ifinfo_req (const struct nlmsghdr *nlh,bool strict_check,struct nlattr **tb,struct netlink_ext_ack *extack)
net/ipv4/ip_gre.c +6 -0
@@ -1406,6 +1406,9 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],struct ip_tunnel_parm p;int err; +if (!rtnl_dev_link_net_capable (dev, t->net)) +return -EPERM ; + err =ipgre_newlink_encap_setup (dev, data);if (err)return err;
@@ -1435,6 +1438,9 @@ static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],struct ip_tunnel_parm p;int err; +if (!rtnl_dev_link_net_capable (dev, t->net)) +return -EPERM ; + err =ipgre_newlink_encap_setup (dev, data);if (err)return err;
Signature · 1 line
2.53.0