From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5400725B2F4 for ; Thu, 12 Feb 2026 20:59:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770929964; cv=none; b=jDrSLAU/3yN2oH5jLYJ4088oxglYKWmeCKnrf7MeX+04t0po+IKvon6hF4tVLipOKLV4rUYUki/qFz5xi5e0vXiI8kKBFbF9P4f8mWMgZPhm/iWb4T4Ozd2U2RfMt70Ae8Ue/D32trurbiSfDEBeUhv2vbBOICbXLANaCXY2vko= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770929964; c=relaxed/simple; bh=ziWt0RFFJB//dguhCOZsTWBS7bikbzN56Hn8z31e0xA=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=LmETJPS2Z4/spHhY2ltNzQZzzgtLRM4R5R0RT8mf6xj9iVJn8VtvaLF6nFbvfiGmoxoRpjupoj/1YmXGOqn/JOEdoQ2A8II7v1gI4d+apkbYP7VujsnmILQyRM1oUyJZMHskLuc9NoNOBS5R+vo8hQOL/GApODQJCZMBU/ya7Cc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=XWlsljP0; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=Masf1h3o; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="XWlsljP0"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="Masf1h3o" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770929962; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tjHShH1itfWbTnxfitY+x2Nc4ZzHnojh1ZRl24kqzEs=; b=XWlsljP0ZqmzzKdfRJbew0XegUk2fJn7uSBFkHtAkIvG8qtooCLgdxVE+VpgLGjdeQu4ru s4Qq85Nhso4AKKM9UVWDRSVXPIWsjjwTEitgsbGoKHVL9OyAmtovSoFXJbOGX1XjnC24mH I9P/1yF86yPVUXL3swavw4oZ19ypGBM= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-493-3aY4_wIcOVGNUWPjZwGm6A-1; Thu, 12 Feb 2026 15:59:21 -0500 X-MC-Unique: 3aY4_wIcOVGNUWPjZwGm6A-1 X-Mimecast-MFC-AGG-ID: 3aY4_wIcOVGNUWPjZwGm6A_1770929960 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4836cf00787so7205235e9.1 for ; Thu, 12 Feb 2026 12:59:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1770929960; x=1771534760; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=tjHShH1itfWbTnxfitY+x2Nc4ZzHnojh1ZRl24kqzEs=; b=Masf1h3oYMD8qg1vEm8SKgeoD635SLr4JrRs5/cHsaOWDJlLV+kNZGa2vMzJy7wQ06 zSkY+t61craz1HI68l5uvzkEM97WQzM0LO3/kgs/bGK2Pkz+A15cSd+WoAEW+byB26O/ 3d+peQ667esAoWSqxkrdvTkHF41txVgMbICSmOSdXlcnuVgSw1igRwVDgREJ4H81EYbS 4Cm/wD/arURB8f8AHMUb1rQEePVkXDNxDMmAPsM4lje5+WYXWXyHg1CIJzahIB7hFpUu 3scJn2m2mKX9ZoWbKJwe5mJLoNbW1m9hfk7zn2yUdqNVXicIWern20TO1jN4nLGQWMP7 pRzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770929960; x=1771534760; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=tjHShH1itfWbTnxfitY+x2Nc4ZzHnojh1ZRl24kqzEs=; b=t/ItGh/gmnBeoZR5KiHOH3ZnqBtFhwjgwxjnOV+A43rSuSruYFkdVq50e3s25nU1Es C6ZBQBR2jZDKgnFkWzH9QF7HJ4fpAtW4fOX/hips9lcs8DVmoIMObVcTt9ecDNFwg3bX RamdmkG/4FfcxPogiIanPNPj6OW+ATQJRAPyFYZEjW9iovYRPqcBRO7uGujeMdXBUYml MyVGZ5+osuLHYcYQDGwo3xjAex7K9Q7gUGE/SQDsbIX5HOjWzXtRNrpkX5EGgxMAfGIR lP+e5moJsMbTcRwVPA6SX77hrKcRgBChXmIgb0XXftTozTZKKwRn+Ea80Zgfq57FiVrq m43Q== X-Forwarded-Encrypted: i=1; AJvYcCXYwfpTLLot/vpGlrUCR4sjnJfzy7oKaPagQzitEAXmIRdZR8Nuxiqxcvhas8GJMEVoq9svUImR2HgmYkc=@vger.kernel.org X-Gm-Message-State: AOJu0Yw7CoIr+k/ctfsryoy1yKHWYyJE/n9jQibCvfQc+u/bj9VNKFIa mlvldMmH8DirKEqWBb/a4cjN92mU8WB49taqxRi0YoP8iuJMLO3yaZxexqfkBi7UWvdVD1Nq304 Yz4nAnSwFCQY72TvJ1cZMfZ8TpVOfE3Ipz7v7TbwpQ7yhoQPrh4gx/1cNX0k+O5Ebxw== X-Gm-Gg: AZuq6aJBA6F8d7kPgLHu45GQSDRW21fU3gylQyuUkG3izwZ2PwN3G3VbUR7qStW1p+q cJIQVh+dVLbTwCMDhm2Ins+QzoO66ZbRUUzMoPYLyXkGYNWY4hY15muno9q9ertyv0+L4EIuMFP f49XLeD5CpEL3E+a2hsDQYcy8Yg/mFptoVoH+pwLVCx0mCI1WeOvhchLXalsYLExJrCWm/ZPn7r 36IZVMbByIl39myuy9N2nmrRQuoWiOrN8LU2UOdEMa8NERqPmpd+trKcKhKobDaJkyALpt5VkEt GnUgG1EsdLRaM512H4KaiODBqE9W+X9dbW+EEJ2l311yjPd5tgiHofVgiDofYwUg/7za53wck38 JHfxIlK+nPGnxoJChhHQCf++xhttmyyOeLkMAyoETuIg9jjhnpQVX+fvo3A== X-Received: by 2002:a05:600c:81e:b0:477:9a61:fd06 with SMTP id 5b1f17b1804b1-48365fe67abmr42250475e9.8.1770929959674; Thu, 12 Feb 2026 12:59:19 -0800 (PST) X-Received: by 2002:a05:600c:81e:b0:477:9a61:fd06 with SMTP id 5b1f17b1804b1-48365fe67abmr42250385e9.8.1770929959261; Thu, 12 Feb 2026 12:59:19 -0800 (PST) Received: from stex1 (host-82-53-134-58.retail.telecomitalia.it. [82.53.134.58]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4834d930902sm189202405e9.15.2026.02.12.12.59.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Feb 2026 12:59:18 -0800 (PST) From: Stefano Garzarella To: netdev@vger.kernel.org Cc: Eric Dumazet , linux-kernel@vger.kernel.org, Bobby Eshleman , Jakub Kicinski , Stefano Garzarella , virtualization@lists.linux.dev, Paolo Abeni , "Michael S. Tsirkin" , Simon Horman , "David S. Miller" Subject: [PATCH net 0/2] vsock: fix child netns mode initialization and restriction Date: Thu, 12 Feb 2026 21:59:14 +0100 Message-ID: <20260212205916.97533-1-sgarzare@redhat.com> X-Mailer: git-send-email 2.53.0 Content-Type: text/plain; charset="utf-8" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This series fixes two issues in the vsock network namespace support recently introduced by commit eafb64f40ca4 ("vsock: add netns to vsock core"). Patch 1 fixes `child_ns_mode` being always hardcoded to "global" for new namespaces, breaking propagation of the "local" mode through nested namespaces. Patch 2 prevents a "local" namespace from switching `child_ns_mode` to "global", which would allow nested namespaces to escape vsock isolation and access global CIDs. Stefano Garzarella (2): vsock: fix child netns mode initialization vsock: prevent child netns mode switch from local to global net/vmw_vsock/af_vsock.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 2.53.0