[BUG] net/sched: TEQL qdisc can modify init-net teql0 from another netns

[shaos]

Hello,

A process running as UID/GID 65534 creates a user and network namespace, sets a namespace-local dummy device to MTU 60000, and installs a root qdisc of kind teql0. TEQL reuses its global master and changes the init network namespace teql0 device from MTU 1500 to 60000.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/5a9460785f381e5feb8decc5dead00b8/raw/a87637a25fcc759de83709b4fb0fe8f7cb03d089/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/5a9460785f381e5feb8decc5dead00b8/raw/8039a72c1de72497f040f40b7507fd8d2103425d/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/c800422c572d258de956971217d3b6dc/raw/53eca8ea2f399fd3de75aa2b38423c3928c9825a/poc.c

Build the tested kernel with the attached configuration, compile the reproducer, and boot it in a disposable QEMU VM with TEQL enabled. The reproducer creates user and network namespaces as an unprivileged UID, then sends the netlink requests.

Impact and prerequisites:
This crosses a network-namespace boundary: an unprivileged user-namespace process changes a globally visible network device. The reproducer also shows that a direct unprivileged MTU change in the initial namespace is denied and a pfifo control does not change teql0.

Validation: Two fresh QEMU boots at the exact v7.3 revision reproduced the change. The pfifo and direct-EPERM controls passed.

Thanks,

shaos