From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02E3E37FF7F for ; Sat, 22 Aug 2026 21:27:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787434063; cv=none; b=BNc3JhGwTZTKZBAwIVIWSupzrQHy+/d8GIkzI/04o1L44fP2quHdbvzEb6xemDNRlXGMLNRxc1HhfsspoVm/LNsBaayJ3WotEQWrQzXfAEeCKgGe4yb6V7Zu+IPsncWx+gutf0pczideP8Nn72jvL0sD4sa5nWivF8JjFFAOAcM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787434063; c=relaxed/simple; bh=KHTD1caALw6V0BqSg/W8Zp5mNmLkbtqeJba7JNF/7bY=; h=From:To:Cc:References:In-Reply-To:Subject:Date:Message-ID: MIME-Version:Content-Type; b=k4Eh2KevMJm7WDrKNXWa/m/4xQ27n6u9SEXp4VbE6aWGGwgviSYzygLZcZmRKDsmYGrfA1uTX+bcpFd8neQnEk37Mc1GgO+Q1P69plkPX/+XTBgERvmQSb2dF/N8TzfClR/Wv7dA2Yge4W0bvr3TcfOcZe5aWmVFJ+GLmKtKzrQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=TbKA4v1q; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=YntqpJWI; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="TbKA4v1q"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="YntqpJWI" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67MKYV2g2026258 for ; Sat, 22 Aug 2026 21:27:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 3qTkSmgP4KdeYbIBStAHrmps5IEWYO1lVTKEUcn26ps=; b=TbKA4v1qrLNs45cD cerpe7+nipn12ErSTLR5sBHAoTwlc5A53meRZWDLLQU7dMqusjXyuc5K4QDVaSM0 sYALsmAMQi6I0w9/p1VjctNS+LQ81z54pth4YPzSVjfDhv40RUEdeWYvro4nRVYv xz+YndDj1Vy3Uqep7/Ogw0bZHLxyS2+2jwMUzFOSavxcB2R6hRTleFdk1nfLec5b cowmOjYhbvR46AwfjGp/hOHynIMETqGiAbBOxjpOGiNG4ch9T2FBYnfPPzyQuJmV X768k3O19FWcE+fweY2UJgZxMkdAbmTNVElTHLi4L0nmwwG6LlONZCuK8LKFuRZb 5RN24g== Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4g740f254f-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 22 Aug 2026 21:27:34 +0000 (GMT) Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-84f0d3ab2f4so1580698b3a.1 for ; Sat, 22 Aug 2026 14:27:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1787434054; x=1788038854; darn=vger.kernel.org; h=content-language:thread-index:content-transfer-encoding :content-type:mime-version:message-id:date:subject:in-reply-to :references:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3qTkSmgP4KdeYbIBStAHrmps5IEWYO1lVTKEUcn26ps=; b=YntqpJWIh2dRL3A8FfIdKMIje/7v4QYAEzeYvMgUyQjzCD9FjXD6m1H13Zsahv3xcU EDXUbacJPssCS5Jy0HvfTzxaOMWcvaCHfQoPJl4nqxH1u3CMmX8g/pqgsyH1MmZR1i1M xbW84CKz3WikGcS4oInJQUVe6V+PJxmX4qc2Rwb7bUd0E0UMwTRQA6cu8whAPquk4VMw Wo3zsGl4/1FZIt/hjUm/q2odM7zl6tgU2nepbgvQwFYSoWyymncux+vQoNjPWhYomURE oAwjAUa020c9XzQGdtJJ86b64Fvzb+bYAuX0bNWbbDz8Y4jLrMujZ7r3qmEzulM8KcuQ 0U4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787434054; x=1788038854; h=content-language:thread-index:content-transfer-encoding :content-type:mime-version:message-id:date:subject:in-reply-to :references:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=3qTkSmgP4KdeYbIBStAHrmps5IEWYO1lVTKEUcn26ps=; b=pCQL7vG6oQZNpLQl5m8MNJ7x36kxjbhJdt4HPVbO5qWpScLrFBOdKh+orlqC5R+5d3 YkmeLPp3dw4M26VYzdx5Tydlpa+kP4Y9Z2wX/f+OpI8hbKldpCSpN2t+D90MSVZ6k3Rt QS1nALEErjgvn08M1Q+tQLyHU/EymwED2MF+fMEp4D+Yk+yfPnHoDjJgbjYThjKC30je hqE68s83yfB4SSAvPDeJm2xECTtvBMzoN3AqIMclU7NDY7vPbVP9Qc/pOCaBKWlMfbez ogVejeHyIIR1kXiPBMYGWUJ0/h3gbyhAks9ugQj7VssfkL7Lk5oZ2LDbZdQ38b2qjNyw sIqg== X-Forwarded-Encrypted: i=1; AHgh+RorYhWkAxctbZS8F3qaRO7mi209sml3K1j0kQtDcyA0888i7wX7r7rWxUWyEA99mFZdRuxc4TEWC5//jE0=@vger.kernel.org X-Gm-Message-State: AFuF++lh+msW3wkTg244yxSbAx/8f0TEi4hhZuoFDYvixIx7jE7K5Jfm QAqoJ4GjKU6YJfBDWl5R7vd9SX/lOT8lTjExSyfLuJRrCJeloTGC7slvvXQZR2k7lC/qBJ0lQs4 kIGcJYn6jUCSyM8h+/tBYVG8oxbfa/UQFtpZeO2CgR7lZQq8a6hPtY09gHZCmiLx2Qb0= X-Gm-Gg: AR+sD134nqOlceCqqb+v5uAVxMsdd4FmIcEi4mGxXmku4jyRBhBj9x7VVRVfu299I3T nHATonOrYHW09ho98tCPicPHQ21flo6z88ugdhE8V/srbjwK1FL62uHFw1p6dB2+rCdg1i0TAAt BOR5NDxGLPEIsKNBEam61IOKP9reXGkK1d8Y9raOiFkYracnRz3lCsMASziOFRE3BHo0HdzAc08 c5Obosr7Of4nHiDIBDn0WdwI5kEm0W5LNea6Sqf5DothuQWxRFWpdZ94fWRCOdFessgYacJHhvG 7qYIiXJLxjFjHbRz/3wit1xN+F7ia5wCUriwTi0LZ830Jyn6+fYThpYpE34pBv8vMHa2Y000cd3 iU3OsS+z2pBrCA+TVWSKApz6AgEyCds3uMvLXaFhF5mvpk3a6Pt1XbQLyziSLNOOFIwkhgAA1mw 4Nkyheh7nC X-Received: by 2002:a05:6a20:2d0b:b0:3cc:51ff:c2e7 with SMTP id adf61e73a8af0-3cd4bbdbd2emr14605880637.10.1787434053853; Sat, 22 Aug 2026 14:27:33 -0700 (PDT) X-Received: by 2002:a05:6a20:2d0b:b0:3cc:51ff:c2e7 with SMTP id adf61e73a8af0-3cd4bbdbd2emr14605845637.10.1787434053415; Sat, 22 Aug 2026 14:27:33 -0700 (PDT) Received: from QCOMk1gASIiYhG (66-33-8-210.colorado.intrepidfiber.us. [66.33.8.210]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141860ef75esm10384048c88.7.2026.08.22.14.27.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 22 Aug 2026 14:27:32 -0700 (PDT) From: To: =?utf-8?Q?'J=C3=A9r=C3=A9my_Jean'?= , "'Sean Tranchetti'" Cc: , References: <20260821202845.4053530-2-Jeremy.Jean@oss.cyber.gouv.fr> In-Reply-To: <20260821202845.4053530-2-Jeremy.Jean@oss.cyber.gouv.fr> Subject: RE: [PATCH] net: qualcomm: rmnet: require real-netns admin for bridging Date: Sat, 22 Aug 2026 15:27:32 -0600 Message-ID: <000601dd327d$0b076e00$21164a00$@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQFsHWdoqs4K+aokN91SIeNs+ZCOHLeMvD2A Content-Language: en-us X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODIyMDE4MSBTYWx0ZWRfX+lEV+JLiZJoM sXbz/BaFCQX+BYdDVF638vPjWLDPIZV+id5aoh5zrux2EDSZV3/Ot4R6DYVjA8jW9y0qND2Y/w+ Osv+H1MFYbQ0sMYuUA+QtPpide/v++D1SD3rZrp7MvY1kg9DHrf6auMkNknTei9vWujbzwiYGf/ IcPgNVnqUYC5IERW5GNSg9PDcN19s56ymBXriGt4s5qfMVLACGXIPuCllbRqcLbr4rZxE0JqGZT waXHoVYxPhPfxXzqnkcdRmKYe4rSzlcer1eNmV/ddg2S8M4E0AOrIokJff62daPAAsEqAlE8hh5 ++TmJjlaj5oRLG2HahJHtBYyu5MvJnV36Xmw8soZ+ZFp7GJQKucRA/UEMtkPbwhPnac7s9aLezG x+AssJgoBpmVr9ADHF3NNl9Tpn+Y0htYC2io2v6asRgdLjTf22NdQeEk6Ios2g+k7cHogrhsokc EuRa+XvLye/ZNbH3IdQ== X-Authority-Analysis: v=2.4 cv=BZjoFLt2 c=1 sm=1 tr=0 ts=6a8a1446 cx=c_pps a=rEQLjTOiSrHUhVqRoksmgQ==:117 a=OltkOWFNRHEXGe+8VJKHzA==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=EUspDBNiAAAA:8 a=VwQbUJbxAAAA:8 a=xGJ9mjwN66MZvpvwcm0A:9 a=QEXdDO2ut3YA:10 a=2VI0MkxyNR6bbpdq8BZq:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwODIyMDE4MSBTYWx0ZWRfX3gZB4OKj9ymX vxwG+82GUvdQQvCkaDCJCDv4V3Fl6/lmJil/ClYPlbboqNsDmBbu/+n2fTXuYA/xn4645oNHk5/ zydnOBOt9u24M/8OmhCUyoUszgZ3df4= X-Proofpoint-GUID: 4H2SC-KMxNGPpYQQ_F1-0FJ5tOMpfNwK X-Proofpoint-ORIG-GUID: 4H2SC-KMxNGPpYQQ_F1-0FJ5tOMpfNwK X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-22_07,2026-08-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 priorityscore=1501 clxscore=1015 phishscore=0 suspectscore=0 spamscore=0 adultscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608220181 > -----Original Message----- > From: J=C3=A9r=C3=A9my Jean > Sent: Friday, August 21, 2026 2:29 PM > To: Subash Abhinov Kasiviswanathan > ; Sean Tranchetti > > Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; = J=C3=A9r=C3=A9my Jean > > Subject: [PATCH] net: qualcomm: rmnet: require real-netns admin for = bridging >=20 > An rmnet device remains linked to its real device after it is moved to = a different > network namespace. When it is used as a master, rmnet_add_bridge() = follows > that pointer and switches the real device's port to bridge mode. >=20 > The rtnetlink master operation only requires CAP_NET_ADMIN in the > namespace holding the visible rmnet and slave devices. A caller = privileged only > there can therefore bridge an attacker-controlled interface to the = real device in > another namespace, receiving and transmitting raw traffic across the > namespace boundary. >=20 > Require CAP_NET_ADMIN in the network namespace of the real device = before > configuring the bridge. >=20 > Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode") > Assisted-by: Codex:gpt-5 > Signed-off-by: J=C3=A9r=C3=A9my Jean > --- > drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++ > 1 file changed, 8 insertions(+) >=20 > diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > index bed6f63facf2..45e6c16a5a70 100644 > --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > @@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device > *rmnet_dev, > struct rmnet_port *port, *slave_port; > int err; >=20 > + /* > + * The rtnl path only checks CAP_NET_ADMIN against > dev_net(rmnet_dev), > + * but bridge mode below controls real_dev, which may live in = another > + * netns. > + */ > + if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev))) > + return -EPERM; > + > port =3D rmnet_get_port_rtnl(real_dev); >=20 > /* If there is more than one rmnet dev attached, its probably being I believe the bridge tear down path might need a similar check. I've = also added a minor update to account for the expected comment style. diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c = b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c index bed6f63facf2..0f9734a40ed0 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c @@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, struct rmnet_port *port, *slave_port; int err; =20 + /* The rtnl path only checks CAP_NET_ADMIN against = dev_net(rmnet_dev), + * but bridge mode below controls real_dev, which may live in = another + * netns. + */ + if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev))) + return -EPERM; + port =3D rmnet_get_port_rtnl(real_dev); =20 /* If there is more than one rmnet dev attached, its probably = being @@ -489,7 +496,19 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, int rmnet_del_bridge(struct net_device *rmnet_dev, struct net_device *slave_dev) { - struct rmnet_port *port =3D rmnet_get_port_rtnl(slave_dev); + struct rmnet_priv *priv =3D netdev_priv(rmnet_dev); + struct net_device *real_dev =3D priv->real_dev; + struct rmnet_port *port; + + /* Similar to rmnet_add_bridge(), the rtnl path only checks + * for CAP_NET_ADMIN against dev_net(slave_dev), but tearing + * down the bridge below updates the real_dev's port state, + * which may live in another netns. + */ + if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev))) + return -EPERM; + + port =3D rmnet_get_port_rtnl(slave_dev); =20 rmnet_unregister_bridge(port);