From: Bryam Vargas iucv_packet_type sets neither .dev nor .af_packet_net, so it lands in the machine-global ptype_base[] that __netif_receive_skb_core walks for every frame in every namespace, and afiucv_hs_rcv() ignores its dev argument. An ETH_P_AF_IUCV frame sent from any namespace holding CAP_NET_RAW is therefore matched against the global iucv_sk_list and can move a socket owned by the initial namespace: afiucv_hs_callback_synfin() and _fin() overwrite its sk_state, and _syn() builds an accept-queue child. Filter on the namespace. The core does not do it for ptype_base[] -- net/core/dev.c leaves namespace filtering to the ptype owner -- and net/x25/x25_dev.c and net/ieee802154/socket.c both test dev_net(dev) at exactly this point. Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas --- net/iucv/af_iucv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index ea047bab65e7..e3ec965d96ca 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -2064,6 +2064,11 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, int err = NET_RX_SUCCESS; char nullstring[8]; + if (!net_eq(dev_net(dev), &init_net)) { + kfree_skb(skb); + return NET_RX_SUCCESS; + } + if (!pskb_may_pull(skb, sizeof(*trans_hdr))) { kfree_skb(skb); return NET_RX_SUCCESS; -- 2.55.0