[PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

[PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

[Jérémy Jean]

An rmnet device remains linked to its real device after it is moved to a
different network namespace. When it is used as a master, rmnet_add_bridge()
follows that pointer and switches the real device's port to bridge mode.

The rtnetlink master operation only requires CAP_NET_ADMIN in the namespace
holding the visible rmnet and slave devices. A caller privileged only there
can therefore bridge an attacker-controlled interface to the real device
in another namespace, receiving and transmitting raw traffic across the
namespace boundary.

Require CAP_NET_ADMIN in the network namespace of the real device before
configuring the bridge.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..45e6c16a5a70 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;
 
+	/*
+	 * The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	/* If there is more than one rmnet dev attached, its probably being

RE: [PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

[subash.a.kasiviswanathan]

> -----Original Message-----
> From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> Sent: Friday, August 21, 2026 2:29 PM
> To: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@oss.qualcomm.com>; Sean Tranchetti
> <sean.tranchetti@oss.qualcomm.com>
> Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Jérémy Jean
> <Jeremy.Jean@oss.cyber.gouv.fr>
> Subject: [PATCH] net: qualcomm: rmnet: require real-netns admin for bridging
> 
> An rmnet device remains linked to its real device after it is moved to a different
> network namespace. When it is used as a master, rmnet_add_bridge() follows
> that pointer and switches the real device's port to bridge mode.
> 
> The rtnetlink master operation only requires CAP_NET_ADMIN in the
> namespace holding the visible rmnet and slave devices. A caller privileged only
> there can therefore bridge an attacker-controlled interface to the real device in
> another namespace, receiving and transmitting raw traffic across the
> namespace boundary.
> 
> Require CAP_NET_ADMIN in the network namespace of the real device before
> configuring the bridge.
> 
> Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> index bed6f63facf2..45e6c16a5a70 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> @@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device
> *rmnet_dev,
>  	struct rmnet_port *port, *slave_port;
>  	int err;
> 
> +	/*
> +	 * The rtnl path only checks CAP_NET_ADMIN against
> dev_net(rmnet_dev),
> +	 * but bridge mode below controls real_dev, which may live in another
> +	 * netns.
> +	 */
> +	if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
> +		return -EPERM;
> +
>  	port = rmnet_get_port_rtnl(real_dev);
> 
>  	/* If there is more than one rmnet dev attached, its probably being

I believe the bridge tear down path might need a similar check. I've also added a minor update to account for the expected comment style.

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..0f9734a40ed0 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
        struct rmnet_port *port, *slave_port;
        int err;
 
+       /* The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev),
+        * but bridge mode below controls real_dev, which may live in another
+        * netns.
+        */
+       if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+               return -EPERM;
+
        port = rmnet_get_port_rtnl(real_dev);
 
        /* If there is more than one rmnet dev attached, its probably being
@@ -489,7 +496,19 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 int rmnet_del_bridge(struct net_device *rmnet_dev,
                     struct net_device *slave_dev)
 {
-       struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
+       struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+       struct net_device *real_dev = priv->real_dev;
+       struct rmnet_port *port;
+
+       /* Similar to rmnet_add_bridge(), the rtnl path only checks
+        * for CAP_NET_ADMIN against dev_net(slave_dev), but tearing
+        * down the bridge below updates the real_dev's port state,
+        * which may live in another netns.
+        */
+       if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+               return -EPERM;
+
+       port = rmnet_get_port_rtnl(slave_dev);
 
        rmnet_unregister_bridge(port);