[PATCH net v2] net: qualcomm: rmnet: require real-netns admin for bridging

[Jérémy Jean]

An rmnet device keeps its link to the real device when moved to another
network namespace. The bridge callbacks change the real port, but rtnetlink
only checks CAP_NET_ADMIN in the slave device's namespace.

Require CAP_NET_ADMIN in the real device's namespace before adding or
removing a bridge. Use the slave device's namespace for the comparison,
since that is the namespace rtnetlink authorized.

Fixes: 60d58f971c10 ("net: qualcomm: rmnet: Implement bridge mode")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---

Changes in v2, after Subash Abhinov's review:
- Add the teardown check and use slave_dev for both capability checks.

v1: https://lore.kernel.org/all/20260821202845.4053530-2-Jeremy.Jean@xxxxxxxxxxxxxxxxx/

 .../ethernet/qualcomm/rmnet/rmnet_config.c    | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index bed6f63facf2..62d7acb13e0c 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -441,6 +441,13 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 	struct rmnet_port *port, *slave_port;
 	int err;
 
+	/* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev),
+	 * but bridge mode below controls real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
+		return -EPERM;
+
 	port = rmnet_get_port_rtnl(real_dev);
 
 	/* If there is more than one rmnet dev attached, its probably being
@@ -489,7 +496,18 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
 int rmnet_del_bridge(struct net_device *rmnet_dev,
 		     struct net_device *slave_dev)
 {
-	struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
+	struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+	struct net_device *real_dev = priv->real_dev;
+	struct rmnet_port *port;
+
+	/* The rtnl path only checks CAP_NET_ADMIN against dev_net(slave_dev),
+	 * but bridge teardown also updates real_dev, which may live in another
+	 * netns.
+	 */
+	if (!rtnl_dev_link_net_capable(slave_dev, dev_net(real_dev)))
+		return -EPERM;
+
+	port = rmnet_get_port_rtnl(slave_dev);
 
 	rmnet_unregister_bridge(port);