[PATCH] net: qualcomm: rmnet: require...

[PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

From: Jérémy Jean <hidden>
Date: 2026-08-21 20:29:30

An rmnet device remains linked to its real device after it is moved to a
different network namespace. When it is used as a master, rmnet_add_bridge()
follows that pointer and switches the real device's port to bridge mode.

The rtnetlink master operation only requires CAP_NET_ADMIN in the namespace
holding the visible rmnet and slave devices. A caller privileged only there
can therefore bridge an attacker-controlled interface to the real device
in another namespace, receiving and transmitting raw traffic across the
namespace boundary.

Require CAP_NET_ADMIN in the network namespace of the real device before
configuring the bridge.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <redacted>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..45e6c16a5a70 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c

@@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;
 
+	/*
+	 * The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	/* If there is more than one rmnet dev attached, its probably being

RE: [PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

From: <subash.a.kasiviswanathan@oss.qualcomm.com>
Date: 2026-08-22 21:27:41

quoted hunk

-----Original Message-----
From: Jérémy Jean <redacted>
Sent: Friday, August 21, 2026 2:29 PM
To: Subash Abhinov Kasiviswanathan
[off-list ref]; Sean Tranchetti
[off-list ref]
Cc: netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Jérémy Jean
[off-list ref]
Subject: [PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

An rmnet device remains linked to its real device after it is moved to a different
network namespace. When it is used as a master, rmnet_add_bridge() follows
that pointer and switches the real device's port to bridge mode.

The rtnetlink master operation only requires CAP_NET_ADMIN in the
namespace holding the visible rmnet and slave devices. A caller privileged only
there can therefore bridge an attacker-controlled interface to the real device in
another namespace, receiving and transmitting raw traffic across the
namespace boundary.

Require CAP_NET_ADMIN in the network namespace of the real device before
configuring the bridge.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <redacted>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c

b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..45e6c16a5a70 100644

--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c

@@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device

*rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;

+	/*
+	 * The rtnl path only checks CAP_NET_ADMIN against
dev_net(rmnet_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);

 	/* If there is more than one rmnet dev attached, its probably being

I believe the bridge tear down path might need a similar check. I've also added a minor update to account for the expected comment style.

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..0f9734a40ed0 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c

@@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
        struct rmnet_port *port, *slave_port;
        int err;
 
+       /* The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev),
+        * but bridge mode below controls real_dev, which may live in another
+        * netns.
+        */
+       if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+               return -EPERM;
+
        port = rmnet_get_port_rtnl(real_dev);
 
        /* If there is more than one rmnet dev attached, its probably being

@@ -489,7 +496,19 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 int rmnet_del_bridge(struct net_device *rmnet_dev,
                     struct net_device *slave_dev)
 {
-       struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
+       struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+       struct net_device *real_dev = priv->real_dev;
+       struct rmnet_port *port;
+
+       /* Similar to rmnet_add_bridge(), the rtnl path only checks
+        * for CAP_NET_ADMIN against dev_net(slave_dev), but tearing
+        * down the bridge below updates the real_dev's port state,
+        * which may live in another netns.
+        */
+       if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+               return -EPERM;
+
+       port = rmnet_get_port_rtnl(slave_dev);
 
        rmnet_unregister_bridge(port);

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help