[PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[Jérémy Jean]

An rmnet device keeps its link to the real device when moved to another
network namespace. The bridge callbacks change the real port, but rtnetlink
only checks CAP_NET_ADMIN in the slave device's namespace.

Require CAP_NET_ADMIN in the real device's namespace before adding or
removing a bridge. Use the slave device's namespace for the comparison,
since that is the namespace rtnetlink authorized.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---

Changes in v2, after Subash Abhinov's review:
- Add the teardown check and use slave_dev for both capability checks.

v1: https://lore.kernel.org/all/20260821202845.4053530-2-Jeremy.Jean@oss.cyber.gouv.fr/

 .../ethernet/qualcomm/rmnet/rmnet_config.c    | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..62d7acb13e0c 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;
 
+	/* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	/* If there is more than one rmnet dev attached, its probably being
@@ -489,7 +496,18 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 int rmnet_del_bridge(struct net_device *rmnet_dev,
 		     struct net_device *slave_dev)
 {
-	struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
+	struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+	struct net_device *real_dev = priv->real_dev;
+	struct rmnet_port *port;
+
+	/* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev),
+	 * but bridge teardown also updates real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
+		return -EPERM;
+
+	port = rmnet_get_port_rtnl(slave_dev);
 
 	rmnet_unregister_bridge(port);
 

Re: [PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

RE: [PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[subash.a.kasiviswanathan]

> -----Original Message-----
> From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> Sent: Sunday, October 4, 2026 2:32 PM
> To: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@oss.qualcomm.com>; Sean Tranchetti
> <sean.tranchetti@oss.qualcomm.com>
> Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Jérémy Jean
> <Jeremy.Jean@oss.cyber.gouv.fr>; stable@vger.kernel.org
> Subject: [PATCH net v2] net: qualcomm: rmnet: require real-netns admin for
> bridging
> 
> An rmnet device keeps its link to the real device when moved to another
> network namespace. The bridge callbacks change the real port, but rtnetlink
> only checks CAP_NET_ADMIN in the slave device's namespace.
> 
> Require CAP_NET_ADMIN in the real device's namespace before adding or
> removing a bridge. Use the slave device's namespace for the comparison, since
> that is the namespace rtnetlink authorized.
> 
> Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
> 
> Changes in v2, after Subash Abhinov's review:
> - Add the teardown check and use slave_dev for both capability checks.
> 
> v1: https://lore.kernel.org/all/20260821202845.4053530-2-
> Jeremy.Jean@oss.cyber.gouv.fr/
> 
>  .../ethernet/qualcomm/rmnet/rmnet_config.c    | 20
> ++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> index bed6f63facf2..62d7acb13e0c 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> @@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device
> *rmnet_dev,
>  	struct rmnet_port *port, *slave_port;
>  	int err;
> 
> +	/* The rtnl path only checks CAP_NET_ADMIN against
> dev_net(slave_dev),
> +	 * but bridge mode below controls real_dev, which may live in another
> +	 * netns.
> +	 */
> +	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
> +		return -EPERM;
> +
>  	port = rmnet_get_port_rtnl(real_dev);
> 
>  	/* If there is more than one rmnet dev attached, its probably being
> @@ -489,7 +496,18 @@ int rmnet_add_bridge(struct net_device
> *rmnet_dev,  int rmnet_del_bridge(struct net_device *rmnet_dev,
>  		     struct net_device *slave_dev)
>  {
> -	struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
> +	struct rmnet_priv *priv = netdev_priv(rmnet_dev);
> +	struct net_device *real_dev = priv->real_dev;
> +	struct rmnet_port *port;
> +
> +	/* The rtnl path only checks CAP_NET_ADMIN against
> dev_net(slave_dev),
> +	 * but bridge teardown also updates real_dev, which may live in
> another
> +	 * netns.
> +	 */
> +	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
> +		return -EPERM;
> +
> +	port = rmnet_get_port_rtnl(slave_dev);
> 
>  	rmnet_unregister_bridge(port);
> 

A similar patch was committed recently in net-next. Please refer to https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=26ee8cd69d46a14b37ba5e512084fe80d730127a

Re: [PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[Jérémy Jean]

On 2026-10-05 07:46, subash.a.kasiviswanathan@oss.qualcomm.com wrote:
>> -----Original Message-----
>> From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>> Sent: Sunday, October 4, 2026 2:32 PM
>> To: Subash Abhinov Kasiviswanathan
>> <subash.a.kasiviswanathan@oss.qualcomm.com>; Sean Tranchetti
>> <sean.tranchetti@oss.qualcomm.com>
>> Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Jérémy Jean
>> <Jeremy.Jean@oss.cyber.gouv.fr>; stable@vger.kernel.org
>> Subject: [PATCH net v2] net: qualcomm: rmnet: require real-netns admin 
>> for
>> bridging
>> 
>> An rmnet device keeps its link to the real device when moved to 
>> another
>> network namespace. The bridge callbacks change the real port, but 
>> rtnetlink
>> only checks CAP_NET_ADMIN in the slave device's namespace.
>> 
>> Require CAP_NET_ADMIN in the real device's namespace before adding or
>> removing a bridge. Use the slave device's namespace for the 
>> comparison, since
>> that is the namespace rtnetlink authorized.
>> 
>> Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
>> Cc: stable@vger.kernel.org
>> Assisted-by: LLM
>> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>> ---
>> 
>> Changes in v2, after Subash Abhinov's review:
>> - Add the teardown check and use slave_dev for both capability checks.
>> 
>> v1: https://lore.kernel.org/all/20260821202845.4053530-2-
>> Jeremy.Jean@oss.cyber.gouv.fr/
>> 
>>  .../ethernet/qualcomm/rmnet/rmnet_config.c    | 20
>> ++++++++++++++++++-
>>  1 file changed, 19 insertions(+), 1 deletion(-)
>> 
>> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
>> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
>> index bed6f63facf2..62d7acb13e0c 100644
>> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
>> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
>> @@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device
>> *rmnet_dev,
>>  	struct rmnet_port *port, *slave_port;
>>  	int err;
>> 
>> +	/* The rtnl path only checks CAP_NET_ADMIN against
>> dev_net(slave_dev),
>> +	 * but bridge mode below controls real_dev, which may live in 
>> another
>> +	 * netns.
>> +	 */
>> +	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
>> +		return -EPERM;
>> +
>>  	port = rmnet_get_port_rtnl(real_dev);
>> 
>>  	/* If there is more than one rmnet dev attached, its probably being
>> @@ -489,7 +496,18 @@ int rmnet_add_bridge(struct net_device
>> *rmnet_dev,  int rmnet_del_bridge(struct net_device *rmnet_dev,
>>  		     struct net_device *slave_dev)
>>  {
>> -	struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
>> +	struct rmnet_priv *priv = netdev_priv(rmnet_dev);
>> +	struct net_device *real_dev = priv->real_dev;
>> +	struct rmnet_port *port;
>> +
>> +	/* The rtnl path only checks CAP_NET_ADMIN against
>> dev_net(slave_dev),
>> +	 * but bridge teardown also updates real_dev, which may live in
>> another
>> +	 * netns.
>> +	 */
>> +	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
>> +		return -EPERM;
>> +
>> +	port = rmnet_get_port_rtnl(slave_dev);
>> 
>>  	rmnet_unregister_bridge(port);
>> 
> 
> A similar patch was committed recently in net-next. Please refer to 
> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=26ee8cd69d46a14b37ba5e512084fe80d730127a

Thanks for the pointer.
I was too slow processing your feedbacks, but good that it is patched.

Regards,
Jérémy