Re: [PATCH] vsock/vmci: reject datagram binds in local network namespaces

[Bobby Eshleman <bobbyeshleman@meta.com>]

On Fri, Nov 13, 2026 at 06:04:40PM +0100, Sergio Lopez wrote:
> VMCI already rejects datagram sends from local network namespaces, but a
> datagram bind still creates a receive handle in VMCI's global port space.
> A VMCI sender outside the namespace can therefore deliver to the local
> socket. Its handle also prevents a global-namespace socket from binding
> the same port.
> 
> Reject VMCI datagram binds in local namespaces. No namespace-local
> datagram transport exists, so EOPNOTSUPP reflects the available receive
> paths. The receive callback also rejects any local-mode socket as a
> defensive check.
> 
> In a KASAN/lockdep QEMU guest, a reproducer observed cross-namespace
> delivery and the global port collision before the fix. After the fix,
> local bind returns EOPNOTSUPP, the global bind succeeds, and a global
> VMCI datagram still reaches the global socket.
> 
> Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/sashiko-outbox-212907@kernel.org/
> Signed-off-by: Sergio Lopez <slp@redhat.com>
> ---
>  net/vmw_vsock/vmci_transport.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
> index 1f186e8f8364..282131544c42 100644
> --- a/net/vmw_vsock/vmci_transport.c
> +++ b/net/vmw_vsock/vmci_transport.c
> @@ -627,6 +627,8 @@ static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg)
>  	 * outside of the create and destruct socket functions.
>  	 */
>  	vsk = vsock_sk(sk);
> +	if (!vsock_net_mode_global(vsk))
> +		return VMCI_ERROR_NO_ACCESS;
>  	if (!vmci_transport_allow_dgram(vsk, dg->src.context))
>  		return VMCI_ERROR_NO_ACCESS;
>  
> @@ -1697,6 +1699,10 @@ static int vmci_transport_dgram_bind(struct vsock_sock *vsk,
>  	u32 flags;
>  	int err;
>  
> +	/* VMCI handles are global and cannot serve local namespaces. */
> +	if (!vsock_net_mode_global(vsk))
> +		return -EOPNOTSUPP;
> +
>  	/* VMCI will select a resource ID for us if we provide
>  	 * VMCI_INVALID_ID.
>  	 */
> 
> ---
> base-commit: 65ba8f34ec886ec72b2c07ddc8cf3d815c32869d
> change-id: 20261113-vsock-vmci-netns-isolation-7e46732dcd73
> 
> Best regards,
> -- 
> Sergio Lopez <slp@redhat.com>
> 

Acked-by: Bobby Eshleman <bobbyeshleman@meta.com>