Re: [PATCH net] macvlan: cap IFLA_MACVLAN_BC_QUEUE_LEN to bound broadcast backlog

[Xiang Mei]

On Sat, Jul 25, 2026 at 6:52 AM Doruk Tan Ozturk <doruk@xxxxxxx> wrote:
>
> > Like I said, we use 100k today and are currently running our
> > workload extremely stable with that.
>
> I independently looked at this path, and I think checking authority
> over the lower device may avoid needing an arbitrary queue limit.
>
> A macvlan moved into a child user and network namespace can change
> BC_QUEUE_LEN and BC_CUTOFF even though both affect the shared
> macvlan_port attached to the lower device. The child can also create a
> nested macvlan that resolves back to the same lower device.
>
> I reproduced both paths. Changing BC_QUEUE_LEN from the child changed
> the value reported on a host sibling from 1000 to 65535. Creating a
> nested macvlan changed it to 131072.
>
> IPvlan handles the same namespace arrangement by requiring
> CAP_NET_ADMIN in the physical device's namespace for changelink and
> nested newlink operations. I have a small patch applying the analogous
> check to macvlan, while leaving queue lengths unrestricted for callers
> that administer the lower device.
>
> Xiang, I am happy to send the patch or pass it to you for a v2,
> whichever you prefer. I would preserve the report credit from your
> original patch.
>
> -Doruk

Hi Doruk,

Good catch, and this is entirely your finding, so please send it as your
own patch. It stands on its own and deserves its own authorship and its
own Fixes: tag rather than being folded into my v2.

I am still testing a valid configure uplimit to ensure the
functionality and avoid OOM.
Please let me know if you find a way that makes my v2 unnecessary.

Thanks,
Xiang