github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: qualcomm: rmnet: require CAP_NET_ADMIN in the real device netns for config ops

Browse Source 
An rmnet device may be created with its real device in a different
netns than the rmnet device itself (rmnet_newlink() resolves it in
link_net), and the config paths below only check CAP_NET_ADMIN against
dev_net(dev), while mutating rmnet port state attached to the real
device:

- rmnet_changelink() rewrites the endpoint mux table and
  port->data_format and, via rmnet_vnd_update_dev_mtu(), can shrink the
  MTU of the rmnet endpoint netdevs.
- rmnet_add_bridge() and rmnet_del_bridge(), reachable via
  ndo_add_slave/ndo_del_slave through RTM_SETLINK IFLA_MASTER, flip
  port->rmnet_mode and port->bridge_ep on the real device's port; with
  bridge_ep pointing at a caller-owned device, rmnet_rx_handler() then
  forwards real-device ingress frames to it.
- rmnet_set_coalesce() rewrites the port aggregation parameters via
  ETHTOOL_SCOALESCE (ioctl) or ETHTOOL_MSG_COALESCE_SET (netlink),
  whose capability checks likewise only cover dev's netns.

A caller privileged only in the rmnet device's netns can therefore
rewrite the shared cellular data-path state owned by another netns, and
steer its ingress traffic.

Gate the rtnl paths with rtnl_dev_link_net_capable(), matching the
"require CAP_NET_ADMIN in the device netns for changelink" series
(vxlan/geneve, CVE-2026-68432), and gate the ethtool setter with
ns_capable() in the real device netns, mirroring the check dev_ethtool()
already applies to dev's netns.  Report the new rejections through
extack where one is available.

The gates cover the configuration paths only.  Teardown (RTM_DELLINK
reaching rmnet_dellink(), and rmnet_config_notify_cb() unregistering
the bridge when the slave device is deleted) is intentionally left
ungated: link deletion is normal netdev lifecycle behaviour, and the
changelink series this matches (vxlan/geneve, CVE-2026-68432) gated
only the configuration paths.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260915195642.1912-1-suruurism@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Abdifatah Suruur 2026-09-15 22:56:42 +03:00 committed by Paolo Abeni
parent 5ccdfb2c32
commit 26ee8cd69d
2 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
View File

@ -312,6 +312,12 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
if (!rmnet_is_real_dev_registered(real_dev))
return -ENODEV;
if (!rtnl_dev_link_net_capable(dev, dev_net(real_dev))) {
NL_SET_ERR_MSG_MOD(extack,
"request modifies device in another netns");
return -EPERM;
}
port = rmnet_get_port_rtnl(real_dev);
if (data[IFLA_RMNET_MUX_ID]) {
@ -441,6 +447,12 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
struct rmnet_port *port, *slave_port;
int err;
if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev))) {
NL_SET_ERR_MSG_MOD(extack,
"request modifies device in another netns");
return -EPERM;
}
port = rmnet_get_port_rtnl(real_dev);
/* If there is more than one rmnet dev attached, its probably being
@ -489,7 +501,14 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
int rmnet_del_bridge(struct net_device *rmnet_dev,
struct net_device *slave_dev)
{
struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
struct rmnet_priv *priv = netdev_priv(rmnet_dev);
struct net_device *real_dev = priv->real_dev;
struct rmnet_port *port;
if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
return -EPERM;
port = rmnet_get_port_rtnl(slave_dev);
rmnet_unregister_bridge(port);

11
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
View File

@ -4,9 +4,11 @@
* RMNET Data virtual network driver
*/
#include <linux/capability.h>
#include <linux/etherdevice.h>
#include <linux/ethtool.h>
#include <linux/if_arp.h>
#include <linux/netlink.h>
#include <net/pkt_sched.h>
#include "rmnet_config.h"
#include "rmnet_handlers.h"
@ -240,9 +242,16 @@ static int rmnet_set_coalesce(struct net_device *dev,
struct netlink_ext_ack *extack)
{
struct rmnet_priv *priv = netdev_priv(dev);
struct net_device *real_dev = priv->real_dev;
struct rmnet_port *port;
port = rmnet_get_port_rtnl(priv->real_dev);
if (!ns_capable(dev_net(real_dev)->user_ns, CAP_NET_ADMIN)) {
NL_SET_ERR_MSG_MOD(extack,
"request modifies device in another netns");
return -EPERM;
}
port = rmnet_get_port_rtnl(real_dev);
if (kernel_coal->tx_aggr_max_frames < 1 || kernel_coal->tx_aggr_max_frames > 64)
return -EINVAL;