The netlink policy for IFLA_MACVLAN_BC_QUEUE_LEN accepts any u32, and the value becomes port->bc_queue_len_used, the only cap on how many skbs macvlan_broadcast_enqueue() may queue on port->bc_queue. An unprivileged user owning a user+net namespace (CAP_NET_ADMIN is checked only against the target netns) can set it to 0xffffffff, so the backlog check never trips and every broadcast frame is skb_clone()'d with GFP_ATOMIC and queued. When RX softirq outpaces the bc_work drain (e.g. many ALLMULTI macvlans under a broadcast flood), the queue grows unbounded and OOMs/panics the host. Bound the value with NLA_POLICY_MAX() at 4096, 4x the default of 1000. This keeps headroom above the default while capping the backlog; values above the cap are now rejected with -ERANGE at netlink parse time. Out of memory: Killed process 141 (su) UID:0 Kernel panic - not syncing: System is deadlocked on memory Call Trace: vpanic (kernel/panic.c:650) panic (kernel/panic.c:787) out_of_memory (mm/oom_kill.c:1166) __alloc_frozen_pages_noprof (mm/page_alloc.c:4914) alloc_pages_mpol (mm/mempolicy.c:2490) folio_alloc_noprof (mm/mempolicy.c:2591) filemap_fault (mm/filemap.c:3565) Fixes: d4bff72c8401 ("macvlan: Support for high multicast packet rate") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Xiang Mei (Microsoft) --- drivers/net/macvlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index c40fa331836b..d4cede6393b0 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -37,6 +37,7 @@ #define MACVLAN_HASH_BITS 8 #define MACVLAN_HASH_SIZE (1<