[PATCH net] vlan: prevent cross-netns MII register writes

[Hungyu Lin]

vlan_dev_ioctl() forwards SIOCSMIIREG to the underlying real
device without checking whether the VLAN device and real device
belong to the same network namespace.

A VLAN device can be moved into another network namespace while
its real device remains in the host namespace. This allows a
process with the required privileges in the VLAN device's
namespace to modify PHY registers on the host's real device.

Reject SIOCSMIIREG when the two devices belong to different
network namespaces. Preserve MII reads across namespaces and
allow MII writes when both devices belong to the same namespace.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 net/8021q/vlan_dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index bca0a3693636..0d0904103302 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -416,9 +416,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	ifrr.ifr_ifru = ifr->ifr_ifru;
 
 	switch (cmd) {
+	case SIOCSMIIREG:
+		if (!net_eq(dev_net(dev), dev_net(real_dev)))
+			break;
+		fallthrough;
 	case SIOCGMIIPHY:
 	case SIOCGMIIREG:
-	case SIOCSMIIREG:
 		err = dev_eth_ioctl(real_dev, &ifrr, cmd);
 		break;
 	}
-- 
2.43.0