Re: [PATCH net] vlan: prevent cross-netns MII register writes

[Andrew Lunn <andrew@lunn.ch>]

On Thu, Nov 12, 2026 at 07:56:24AM -0800, Jakub Kicinski wrote:
> On Fri,  6 Nov 2026 12:46:39 +0000 Hungyu Lin wrote:
> > vlan_dev_ioctl() forwards SIOCSMIIREG to the underlying real
> > device without checking whether the VLAN device and real device
> > belong to the same network namespace.
> > 
> > A VLAN device can be moved into another network namespace while
> > its real device remains in the host namespace. This allows a
> > process with the required privileges in the VLAN device's
> > namespace to modify PHY registers on the host's real device.
> > 
> > Reject SIOCSMIIREG when the two devices belong to different
> > network namespaces. Preserve MII reads across namespaces and
> > allow MII writes when both devices belong to the same namespace.
> > 
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> 
> > diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
> > index bca0a3693636..0d0904103302 100644
> > --- a/net/8021q/vlan_dev.c
> > +++ b/net/8021q/vlan_dev.c
> > @@ -416,9 +416,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
> >  	ifrr.ifr_ifru = ifr->ifr_ifru;
> >  
> >  	switch (cmd) {
> > +	case SIOCSMIIREG:
> > +		if (!net_eq(dev_net(dev), dev_net(real_dev)))
> > +			break;
> > +		fallthrough;
> >  	case SIOCGMIIPHY:
> >  	case SIOCGMIIREG:
> > -	case SIOCSMIIREG:
> >  		err = dev_eth_ioctl(real_dev, &ifrr, cmd);
> >  		break;
> >  	}
> 
> Andrew, Florian, any idea if we could delete this completely?
> Why would anyone want to run MII/PHY commands on a VLAN?

It does seem questionable.

Hungyu, do any other virtual devices forward these ioctl calls to the
physical device below? I assume they have the same problem. So we need
a fix for them all.

	 Andrew