Re: [PATCH net-next v13 1/9] net: dsa: add tag driver for LAN9645X

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] net: dsa: lan9645x: VLAN hopping via fragmented in-band VLAN tags
--

commit f7552b4bce99ac2975ea8145332463c0a3772965
Author: Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>

net: dsa: add tag driver for LAN9645X

This commit adds a DSA tag driver for LAN9645x switches using an NPI port.
It implements asymmetric prefix configurations, using a long prefix for
extraction and an internal frame header (IFH) for both extraction and
injection.

> diff --git a/net/dsa/tag_lan9645x.c b/net/dsa/tag_lan9645x.c
> new file mode 100644
> index 0000000000000..f54646d4b3947
> --- /dev/null
> +++ b/net/dsa/tag_lan9645x.c

[ ... ]

> +static struct sk_buff *lan9645x_xmit_get_vlan_info(struct sk_buff *skb,
> +						   struct net_device *br,
> +						   u32 *vlan_tci,
> +						   u32 *tag_type)
> +{
> +	struct vlan_ethhdr *hdr;
> +	u16 proto, tci;

[ ... ]

> +	if (skb_headlen(skb) >= VLAN_ETH_HLEN &&
> +	    ntohs(hdr->h_vlan_proto) == proto) {
> +		vlan_remove_tag(skb, &tci);
> +		*vlan_tci = tci;
> +	} else {

[Severity: Critical]
Does this logic allow VLAN isolation bypass for fragmented in-band VLAN tags? 

If a user with raw socket access constructs a frame where the 14-byte MAC
header is linear, but the in-band 802.1Q VLAN tag is placed in paged
fragments, skb_headlen(skb) >= VLAN_ETH_HLEN will evaluate to false.

Instead of linearizing the header to securely process the VLAN tag using
pskb_may_pull(), the code takes this else branch. This misclassifies the
packet as untagged and assigns it the bridge's PVID, leaving the original
spoofed 802.1Q tag untouched in the payload.

When the frame is later injected into the switch, the hardware rewriter won't
pop the payload tag since the switch believes the frame is untagged. The
packet would then be transmitted on the wire retaining the user's spoofed
802.1Q tag, completely bypassing the bridge's VLAN filtering and isolation.

> +		rcu_read_lock();
> +		br_vlan_get_pvid_rcu(br, &tci);
> +		rcu_read_unlock();
> +		*vlan_tci = tci;
> +	}
> +
> +	*tag_type = (proto != ETH_P_8021Q) ? LAN9645X_IFH_TAG_TYPE_S :
> +					     LAN9645X_IFH_TAG_TYPE_C;
> +
> +	return skb;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929-dsa_lan9645x_switch_driver_base-v13-0-827c2d3617f2@microchip.com?part=1