Re: [PATCH net] vlan: prevent cross-netns MII register writes

[Florian Fainelli <f.fainelli@gmail.com>]

On 11/12/26 08:15, Andrew Lunn wrote:
> On Thu, Nov 12, 2026 at 07:56:24AM -0800, Jakub Kicinski wrote:
>> On Fri,  6 Nov 2026 12:46:39 +0000 Hungyu Lin wrote:
>>> vlan_dev_ioctl() forwards SIOCSMIIREG to the underlying real
>>> device without checking whether the VLAN device and real device
>>> belong to the same network namespace.
>>>
>>> A VLAN device can be moved into another network namespace while
>>> its real device remains in the host namespace. This allows a
>>> process with the required privileges in the VLAN device's
>>> namespace to modify PHY registers on the host's real device.
>>>
>>> Reject SIOCSMIIREG when the two devices belong to different
>>> network namespaces. Preserve MII reads across namespaces and
>>> allow MII writes when both devices belong to the same namespace.
>>>
>>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
>>
>>> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
>>> index bca0a3693636..0d0904103302 100644
>>> --- a/net/8021q/vlan_dev.c
>>> +++ b/net/8021q/vlan_dev.c
>>> @@ -416,9 +416,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
>>>   	ifrr.ifr_ifru = ifr->ifr_ifru;
>>>   
>>>   	switch (cmd) {
>>> +	case SIOCSMIIREG:
>>> +		if (!net_eq(dev_net(dev), dev_net(real_dev)))
>>> +			break;
>>> +		fallthrough;
>>>   	case SIOCGMIIPHY:
>>>   	case SIOCGMIIREG:
>>> -	case SIOCSMIIREG:
>>>   		err = dev_eth_ioctl(real_dev, &ifrr, cmd);
>>>   		break;
>>>   	}
>>
>> Andrew, Florian, any idea if we could delete this completely?
>> Why would anyone want to run MII/PHY commands on a VLAN?
> 
> It does seem questionable.

Agreed, it does not quite make sense to me to forward these ioctl() 
calls. Looks like this predates the import of Linux-2.6.12-rc2 into git, 
need to do some more history digging to find out why this was done.

> 
> Hungyu, do any other virtual devices forward these ioctl calls to the
> physical device below? I assume they have the same problem. So we need
> a fix for them all.
> 
> 	 Andrew


-- 
Florian