[PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging
flat view
COOLING11d
From: Jérémy Jean <hidden>
Date: 2026-10-04 20:32:18
Also in:
lkml, stable
Subsystem:
networking drivers, qualcomm rmnet driver, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Subash Abhinov Kasiviswanathan, Sean Tranchetti, Linus Torvalds
An rmnet device keeps its link to the real device when moved to another
network namespace. The bridge callbacks change the real port, but rtnetlink
only checks CAP_NET_ADMIN in the slave device's namespace.
Require CAP_NET_ADMIN in the real device's namespace before adding or
removing a bridge. Use the slave device's namespace for the comparison,
since that is the namespace rtnetlink authorized.
Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <redacted>
---
Changes in v2, after Subash Abhinov's review:
- Add the teardown check and use slave_dev for both capability checks.
v1: https://lore.kernel.org/all/20260821202845.4053530-2-Jeremy.Jean@oss.cyber.gouv.fr/ (local)
.../ethernet/qualcomm/rmnet/rmnet_config.c | 20 ++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..62d7acb13e0c 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c@@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, struct rmnet_port *port, *slave_port; int err; + /* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev), + * but bridge mode below controls real_dev, which may live in another + * netns. + */ + if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev))) + return -EPERM; + port = rmnet_get_port_rtnl(real_dev); /* If there is more than one rmnet dev attached, its probably being
@@ -489,7 +496,18 @@ int rmnet_add_bridge(struct net_device *rmnet_dev, int rmnet_del_bridge(struct net_device *rmnet_dev, struct net_device *slave_dev) { - struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev); + struct rmnet_priv *priv = netdev_priv(rmnet_dev); + struct net_device *real_dev = priv->real_dev; + struct rmnet_port *port; + + /* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev), + * but bridge teardown also updates real_dev, which may live in another + * netns. + */ + if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev))) + return -EPERM; + + port = rmnet_get_port_rtnl(slave_dev); rmnet_unregister_bridge(port);