Aldo Ariel Panzardo 3b536db8fb net: qrtr: restrict socket creation to the initial network namespace ... QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in. As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide. QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code). Fixes: bdabad3e36 ("net: Add Qualcomm IPC router") Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com> Link: https://patch.msgid.link/20260716154319.3297699-1-qwe.aldo@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-07-23 07:44:00 -07:00
..
af_qrtr.c	net: qrtr: restrict socket creation to the initial network namespace	2026-07-23 07:44:00 -07:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	net: qrtr: combine nameservice into main module	2021-09-28 17:36:43 -07:00
mhi.c	Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)	2026-07-03 07:38:17 +02:00
ns.c	net: qrtr: ns: Raise node count limit to 512	2026-07-21 15:13:14 -07:00
qrtr.h	net: qrtr: fix null-ptr-deref in qrtr_ns_remove	2021-01-05 16:50:09 -08:00
smd.c
tun.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00