Re: [PATCH v2 2/2] vsock/vmci: enforce per-netns mode on the datagram receive path

[Vishnu Dasa]

On Sat, Sep 19, 2026 at 5:32 AM Bartłomiej Dmitruk
<bartlomiej.dmitruk@xxxxxxx> wrote:
>
> The send hook vmci_transport_dgram_allow() refuses datagrams when the socket's
> netns is not in global mode (vsock_net_mode_global()), but the receive path
> (vmci_transport_recv_dgram_cb() -> vmci_transport_allow_dgram()) did not, so a
> socket bound in a non-global (local) netns received datagrams from peers it
> could never send to, defeating namespace isolation.
>
> Add the check at the start of the receive decision, before the
> VMADDR_CID_HYPERVISOR short-circuit, so the hypervisor CID is covered too
> (matching the send side).
>
> This was found by code inspection; I do not have VMCI hardware to test on
> (compile-tested only).
>
> Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
> Signed-off-by: Bartłomiej Dmitruk <bartlomiej.dmitruk@xxxxxxx>
> Assisted-by: Claude (Anthropic)

Reviewed-by: Vishnu Dasa <vishnu.dasa@xxxxxxxxxxxx>

> ---
> v2: perform the netns check first (before the hypervisor early return) so
>     hypervisor datagrams are also gated in local mode -- the Sashiko AI review
>     noted v1 left that path partially bypassed.
> v1: https://lore.kernel.org/netdev/20260917220225.56200-1-bartlomiej.dmitruk@xxxxxxx/
>
> diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
> --- a/net/vmw_vsock/vmci_transport.c
> +++ b/net/vmw_vsock/vmci_transport.c
> @@ -532,6 +532,14 @@
>  static bool vmci_transport_allow_dgram(struct vsock_sock *vsock, u32 peer_cid)
>  {
>         u64 access;
> +
> +       /* Enforce the per-netns mode first, symmetrically with the send hook
> +        * vmci_transport_dgram_allow(): a socket in a non-global (local) netns
> +        * must not receive datagrams it could never send (this also covers the
> +        * hypervisor CID).
> +        */
> +       if (!vsock_net_mode_global(vsock))
> +               return false;
>
>         if (VMADDR_CID_HYPERVISOR == peer_cid)
>                 return true;

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature