[PATCH 1/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX operation

[Yuchao Zhang]

The NETDEV_CMD_BIND_RX operation correctly carries GENL_UNS_ADMIN_PERM
(uns-admin-perm in the YAML spec), requiring CAP_NET_ADMIN within the
caller's network namespace before a process may bind a DMA-BUF to a net
device's RX queues.

The companion NETDEV_CMD_BIND_TX operation for netmem TX support was
merged without any permission flag in both the YAML specification
(Documentation/netlink/specs/netdev.yaml) and the generated C code
(net/core/netdev-genl-gen.c).  As a result, any unprivileged local
process can invoke BIND_TX to bind an arbitrary DMA-BUF file descriptor
to the TX path of a netmem-TX-capable device, bypassing the access
control that protects the equivalent RX operation.

Fix by adding the uns-admin-perm flag to the bind-tx entry in the YAML
spec and the corresponding GENL_UNS_ADMIN_PERM flag to the generated
ops table, making BIND_TX consistent with BIND_RX.

Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuchao Zhang <ndaugoing@xxxxxxxxx>
---
 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/netdev.yaml b/Documentation/netlink/specs/netdev.yaml
index 3e3f03bd5c29..3e38ffc39219 100644
--- a/Documentation/netlink/specs/netdev.yaml
+++ b/Documentation/netlink/specs/netdev.yaml
@@ -851,6 +851,7 @@ operations:
       name: bind-tx
       doc: Bind dmabuf to netdev for TX
       attribute-set: dmabuf
+      flags: [uns-admin-perm]
       do:
         request:
           attributes:
diff --git a/net/core/netdev-genl-gen.c b/net/core/netdev-genl-gen.c
index f83790341eae..e243fba64312 100644
--- a/net/core/netdev-genl-gen.c
+++ b/net/core/netdev-genl-gen.c
@@ -241,7 +241,7 @@ static const struct genl_split_ops netdev_nl_ops[] = {
 		.doit		= netdev_nl_bind_tx_doit,
 		.policy		= netdev_bind_tx_nl_policy,
 		.maxattr	= NETDEV_A_DMABUF_FD,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= NETDEV_CMD_QUEUE_CREATE,
-- 
2.53.0