[PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Aswin Karuvally]

Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
capable check to ensure unprivileged users cannot invoke them.

Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
Cc: stable@vger.kernel.org
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
---
 drivers/s390/net/qeth_core_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 20fb0d2e02a9..f18eed9df3c7 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -6525,6 +6525,9 @@ int qeth_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __user *d
 	struct qeth_card *card = dev->ml_priv;
 	int rc = 0;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	switch (cmd) {
 	case SIOC_QETH_ADP_SET_SNMP_CONTROL:
 		rc = qeth_snmp_command(card, data);
-- 
2.53.0

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] An integer underflow in the buffer size check allows privileged users to cause a kernel heap buffer overflow.
--

--- Patch [1]: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls ---
commit 3ec90fe5fb86d5d8d0432c2487ad687ef4d3e227
Author: Aswin Karuvally <aswin@linux.ibm.com>

s390/qeth: Check CAP_NET_ADMIN for private ioctls

This commit adds a CAP_NET_ADMIN capability check to the
SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and
SIOC_QETH_QUERY_OAT private ioctls. This ensures that these commands cannot
be invoked by unprivileged users.

> diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
> index 20fb0d2e02a9a..f18eed9df3c7a 100644
> --- a/drivers/s390/net/qeth_core_main.c
> +++ b/drivers/s390/net/qeth_core_main.c
> @@ -6525,6 +6525,9 @@ int qeth_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __user *d
>  	struct qeth_card *card = dev->ml_priv;
>  	int rc = 0;
>  
> +	if (!capable(CAP_NET_ADMIN))
> +		return -EPERM;
> +
>  	switch (cmd) {
>  	case SIOC_QETH_ADP_SET_SNMP_CONTROL:
>  		rc = qeth_snmp_command(card, data);

[Severity: High]
This is a pre-existing issue, but does qeth_snmp_command() allow an integer
underflow that leads to a heap buffer overflow?

If a user provides a udata_len smaller than sizeof(struct qeth_snmp_ureq_hdr)
(16 bytes), the unsigned subtraction in the callback underflows:

drivers/s390/net/qeth_core_main.c:qeth_snmp_command() {
    ...
	if (get_user(qinfo.udata_len, &ureq->hdr.data_len) ||
    ...
	qinfo.udata = kzalloc(qinfo.udata_len, GFP_KERNEL);
    ...
	qinfo.udata_offset = sizeof(struct qeth_snmp_ureq_hdr);
    ...
}

drivers/s390/net/qeth_core_main.c:qeth_snmp_command_cb() {
    ...
	if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
    ...
}

The underflow would bypass the available space check, leading to an
out-of-bounds memcpy into the allocated heap buffer.

The same integer underflow pattern appears to exist in qeth_l3_arp_query_cb()
for the SIOC_QETH_ARP_QUERY_INFO ioctl.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723140050.762991-1-aswin@linux.ibm.com?part=1

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Jakub Kicinski]

On Thu, 23 Jul 2026 16:00:50 +0200 Aswin Karuvally wrote:
> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
> capable check to ensure unprivileged users cannot invoke them.

No need to make this netns-aware, I assume?

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Aswin Karuvally]

On 28/07/26 06:36, Jakub Kicinski wrote:
> On Thu, 23 Jul 2026 16:00:50 +0200 Aswin Karuvally wrote:
>> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
>> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
>> capable check to ensure unprivileged users cannot invoke them.
> 
> No need to make this netns-aware, I assume?

Hi Jakub,
Thank you for accepting the patch!

It was concluded that the tools that make use of these calls are
strictly meant for IBM OSA cards on an LPAR, which find very limited use
within environments that make use of network namespaces, eg. containers.
Thus stuck with capable().

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 23 Jul 2026 16:00:50 +0200 you wrote:
> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
> capable check to ensure unprivileged users cannot invoke them.
> 
> Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
> Cc: stable@vger.kernel.org
> Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
> Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
> 
> [...]

Here is the summary with links:
  - [net] s390/qeth: Check CAP_NET_ADMIN for private ioctls
    https://git.kernel.org/netdev/net/c/d211028bac1b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html