[PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Aswin Karuvally]

Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
capable check to ensure unprivileged users cannot invoke them.

Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
Cc: stable@vger.kernel.org
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
---
 drivers/s390/net/qeth_core_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 20fb0d2e02a9..f18eed9df3c7 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -6525,6 +6525,9 @@ int qeth_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __user *d
 	struct qeth_card *card = dev->ml_priv;
 	int rc = 0;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	switch (cmd) {
 	case SIOC_QETH_ADP_SET_SNMP_CONTROL:
 		rc = qeth_snmp_command(card, data);
-- 
2.53.0

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Jakub Kicinski]

On Thu, 23 Jul 2026 16:00:50 +0200 Aswin Karuvally wrote:
> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
> capable check to ensure unprivileged users cannot invoke them.

No need to make this netns-aware, I assume?

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 23 Jul 2026 16:00:50 +0200 you wrote:
> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
> capable check to ensure unprivileged users cannot invoke them.
> 
> Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
> Cc: stable@vger.kernel.org
> Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
> Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
> 
> [...]

Here is the summary with links:
  - [net] s390/qeth: Check CAP_NET_ADMIN for private ioctls
    https://git.kernel.org/netdev/net/c/d211028bac1b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] s390/qeth: Check CAP_NET_ADMIN for private ioctls

[Aswin Karuvally]

On 28/07/26 06:36, Jakub Kicinski wrote:
> On Thu, 23 Jul 2026 16:00:50 +0200 Aswin Karuvally wrote:
>> Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
>> SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
>> capable check to ensure unprivileged users cannot invoke them.
> 
> No need to make this netns-aware, I assume?

Hi Jakub,
Thank you for accepting the patch!

It was concluded that the tools that make use of these calls are
strictly meant for IBM OSA cards on an LPAR, which find very limited use
within environments that make use of network namespaces, eg. containers.
Thus stuck with capable().