From nobody Mon Jul 27 18:58:42 2026 Received: from mail-ej1-f43.google.com (mail-ej1-f43.google.com [209.85.218.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89AE5334681 for ; Thu, 16 Jul 2026 15:43:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784216624; cv=none; b=hWkaYQ8f4EaY5TWYEaRc5EW1wk18+TYjQcSHNAbNygYMEZ2wytK/jNX5Ki+wiZQzARY1IM1GuElbIOIBpsGsZNmOdSjrOyLDreiOTHRjQO4FJdafQ2CpyywgRXpX6eBy/2VEyilXZkQbVjXzqUmTBwFCj/FAvxx2e8XPp2yTjBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784216624; c=relaxed/simple; bh=rH75EzXICa0XdEgVwHY4Yfy9qWAaivBxfj522dz1C6k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=u5DJNngSlGZqCKYwmoiR09C+P9Rf9/OTP6Vo2OaSdrfOp0PewZT+cf5r8jY63CSX0c4hDT16HikX1oEvFXE1Gp53DcAOAZKu2gfBCp5mey3WbuIwfjiAx1aB/LXvOfQyOb0ix6hL3iL3bmNmCsJi8qsllm6Y6gxcdKN7hTkzm1Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Qx0g773o; arc=none smtp.client-ip=209.85.218.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Qx0g773o" Received: by mail-ej1-f43.google.com with SMTP id a640c23a62f3a-c1671ec8692so311112166b.0 for ; Thu, 16 Jul 2026 08:43:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784216620; x=1784821420; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=zBypqS7GnltF0qflde2eBCHFe4sgdKQRHHH8Z6tCV90=; b=Qx0g773oFC9yHmm0fB4xBDoVtAGZmJbBHJTgVyo0ju7t8AsVJ45zSImShPZpH4GlTl 8ckZWmjde9Rj913GfB3aj+0RmpKDiTA3idKum3GFnkY2xTCiw/3ZGivzoJVBwuyY+yV/ Wnh9VPDD9r+Ub3P8/xaOfq0vhEr2dW8YDTYZqK62llV2xVVA9kV8jONrFeuBL4G/oXAC NMG/EiK51bDrZIq8SPVnS9Zg5fxSGe0AclL74UIT6Pko1rjRkHFBUkBwfkNQGfJuphat KNrNwlMdOEZ0beLEn6f5NBjcG5WdAmavabCroOdU4p2HF/m+UzNyWLXwW5UJCONAf3BQ Sarw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784216620; x=1784821420; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zBypqS7GnltF0qflde2eBCHFe4sgdKQRHHH8Z6tCV90=; b=rzL4WXskZymUngH0fvlqimks8bh4HpXvxdHh/fhvkDC9BK35vpDxE10bfXfraVeqLw IKrLINd74dH6gJUS+Jv/Ab92WdaVV8GYUnPXOxXSq7rcn/XRb6qSKDkJNAs3SsVAD+Lo tiqqb1pzdtVheTYwGkhdmQkmX9L79E+F5QhNd469YNb6ZfQTFaatQopmXFlxjQ4LHx4S DywEh5AEbxJ5cW7ZPOHF68RJv+qJTg438kJwQeFHTgTsIrImfV2Fo3/oW2NrUwJ4UpDL HI4p+K8DrXAq2hftloFNgY7FEaj2QF+6zs49VoSW0EK3+GpAmV7K/OrinWUQx5EIDO0Y +OqQ== X-Forwarded-Encrypted: i=1; AHgh+Rp/jdeqMmbAaHD3yBEaZk44ZtDyhGDfvMy+4wYbrYu9CNYKBdKbnRg7V4iq9/r1RszUpHedeX8zAx+wBSI=@vger.kernel.org X-Gm-Message-State: AOJu0YzugNTYkZbZjYRyrfca5Rr/+ZWe2O4NNvDU5aDFAJi1uCfutgbv bC86HzcEFN9xfTfPkkbvEpG1PK4FIiTyILGSy15ZnOqLG+VDTe2DzGTn X-Gm-Gg: AfdE7cmU5q73KANPbxtY1BEqH6bQCPqOkOf+t+KEjYlsYCXlBUuixIGevwVzmYGRlYm Cw4fsWlAQBLmRy7L0V0VRuLc1WEJrDSHOviEwl47CkU+HMf2FYJuifxzVQhdhsPcXBxDAcLX8p0 CoI/YF1+ttEEIqpBf+es8vGvM5MJj2HarF/apmaAOVha9wFSY8huwj7LhbPskA5jdNbi/NVgU8N EtEkXmHlRA/vKJG4RIZasQMjtzg9Tu0MUaRsXAzZBhzvSu0tbp5y6AcU68HhBjuMO0P7jeky0nh qITBqd0wk1PTwMirH+cBIs3/Pu/UXUOVrycoxcdqIbN38Xe9GUssQc5RHcy3EqTEt6zy2xappOR XC1KZBLrznUGX/uoJi+6ERZY5MOW7ghfm0PQmgh6y2eICDeJbmifSzPzFMVv0tKoXR+yPBg== X-Received: by 2002:a17:907:3e12:b0:c12:8664:6aec with SMTP id a640c23a62f3a-c1679364167mr456134966b.53.1784216619477; Thu, 16 Jul 2026 08:43:39 -0700 (PDT) Received: from beelink.. ([164.5.253.70]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c168a1083c7sm195166566b.30.2026.07.16.08.43.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2026 08:43:38 -0700 (PDT) From: Aldo Ariel Panzardo To: Manivannan Sadhasivam , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Simon Horman , Bjorn Andersson , netdev@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Aldo Ariel Panzardo Subject: [PATCH net] net: qrtr: restrict socket creation to the initial network namespace Date: Thu, 16 Jul 2026 12:43:19 -0300 Message-ID: <20260716154319.3297699-1-qwe.aldo@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a single global node id (always 1) and qrtr_ports is a single global xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that global state with no network-namespace check, and qrtr_create() places no restriction on the namespace a socket is created in. As a result an unprivileged process that creates an AF_QIPCRTR socket in a separate network namespace, e.g. via unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR sockets owned by another namespace, and vice versa. The receiving socket sees such a message as coming from node id 1, indistinguishable from a legitimate local client, breaking the isolation that network namespaces are expected to provide. QRTR is a transport to global hardware endpoints (the modem and other remote processors) and has no per-namespace semantics; its in-kernel name service already creates its socket in init_net only. Confine the socket family to the initial network namespace, as other non-namespace-aware socket families do (see llc_ui_create() and the ieee802154 socket code). Fixes: bdabad3e363d ("net: Add Qualcomm IPC router") Signed-off-by: Aldo Ariel Panzardo --- net/qrtr/af_qrtr.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c index d02ef9a74c3c..a30fa56e6aa3 100644 --- a/net/qrtr/af_qrtr.c +++ b/net/qrtr/af_qrtr.c @@ -1263,6 +1263,14 @@ static int qrtr_create(struct net *net, struct socke= t *sock, if (sock->type !=3D SOCK_DGRAM) return -EPROTOTYPE; =20 + /* QRTR keeps its port and node state in module-global variables that + * are not partitioned per network namespace, and the in-kernel name + * service only operates in init_net. Confine the family to init_net so + * a socket in another namespace cannot reach the global control plane. + */ + if (!net_eq(net, &init_net)) + return -EAFNOSUPPORT; + sk =3D sk_alloc(net, AF_QIPCRTR, GFP_KERNEL, &qrtr_proto, kern); if (!sk) return -ENOMEM; --=20 2.43.0