Re: [PATCH net] macvlan: cap IFLA_MACVLAN_BC_QUEUE_LEN to bound broadcast backlog

[Doruk Tan Ozturk]

> Like I said, we use 100k today and are currently running our
> workload extremely stable with that.

I independently looked at this path, and I think checking authority
over the lower device may avoid needing an arbitrary queue limit.

A macvlan moved into a child user and network namespace can change
BC_QUEUE_LEN and BC_CUTOFF even though both affect the shared
macvlan_port attached to the lower device. The child can also create a
nested macvlan that resolves back to the same lower device.

I reproduced both paths. Changing BC_QUEUE_LEN from the child changed
the value reported on a host sibling from 1000 to 65535. Creating a
nested macvlan changed it to 131072.

IPvlan handles the same namespace arrangement by requiring
CAP_NET_ADMIN in the physical device's namespace for changelink and
nested newlink operations. I have a small patch applying the analogous
check to macvlan, while leaving queue lengths unrestricted for callers
that administer the lower device.

Xiang, I am happy to send the patch or pass it to you for a v2,
whichever you prefer. I would preserve the report credit from your
original patch.

-Doruk