[PATCH] net: qualcomm: rmnet: require real-netns admin for bridging

[Jérémy Jean]

An rmnet device remains linked to its real device after it is moved to a
different network namespace. When it is used as a master, rmnet_add_bridge()
follows that pointer and switches the real device's port to bridge mode.

The rtnetlink master operation only requires CAP_NET_ADMIN in the namespace
holding the visible rmnet and slave devices. A caller privileged only there
can therefore bridge an attacker-controlled interface to the real device
in another namespace, receiving and transmitting raw traffic across the
namespace boundary.

Require CAP_NET_ADMIN in the network namespace of the real device before
configuring the bridge.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..45e6c16a5a70 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -441,6 +441,14 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;
 
+	/*
+	 * The rtnl path only checks CAP_NET_ADMIN against dev_net(rmnet_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(rmnet_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	/* If there is more than one rmnet dev attached, its probably being