[PATCH wpan] ieee802154: look up the wpan_phy dump ifindex in the caller's netns

[PATCH wpan] ieee802154: look up the wpan_phy dump ifindex in the caller's netns

[Maoyi Xie]

nl802154_dump_wpan_phy_parse() looks up NL802154_ATTR_IFINDEX in
init_net, while the dump only returns phys in the caller's netns. For a
caller outside init_net, the result depends on what the ifindex is in
init_net. If no device there has it, the dump returns -ENODEV, even
when the ifindex is one of the caller's own 802.15.4 interfaces. If an
802.15.4 interface there has it, the dump is empty. If any other device
there has it, the filter is ignored and the dump returns every phy in
the caller's netns.

GET_WPAN_PHY needs no privilege, so an unprivileged process outside
init_net can use this to tell which ifindexes exist in init_net.

Look the ifindex up in sock_net(skb->sk), as nl80211_dump_wiphy_parse()
does. Commit 66e5c2672cd1 ("ieee802154: add netns support") added the
netns check to the dump loop. It also removed the "TODO netns" comment
above this lookup but kept init_net.

Fixes: 66e5c2672cd1 ("ieee802154: add netns support")
Cc: stable@vger.kernel.org # v4.8+
Assisted-by: LLM codeql
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
I asked about this on linux-wpan and netdev in September [1].

Found with a CodeQL check for lookups done in init_net. Tested on an
unmodified v7.3 and on v7.3 with this patch, in qemu with two
mac802154_hwsim radios and phy1 moved into netns ns1. Not tested on
real 802.15.4 hardware. Dumps from ns1, filtered by ifindex:

  ifindex in the filter                     before fix   with fix
  4: wpan1 in ns1, unused in init_net       -ENODEV      phy1
  3: wpan0 in init_net, unused in ns1       empty        -ENODEV
  5: sit0 in init_net, unused in ns1        phy1         -ENODEV
  3: wpan0 in init_net, new wpan2 in ns1    empty        phy1

Rows 1 to 3 give the same results for uid 65534 in ns1. For uid 65534
in its own user and net namespace, which has no phy, ifindex 3 and 5
return an empty dump before the fix and -ENODEV with it. Unfiltered
dumps and dumps from init_net do not change.

[1] https://lore.kernel.org/all/20260920165057.3753458-1-maoyixie.tju@gmail.com/

 net/ieee802154/nl802154.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 115f43d0e158..fae5c413fa60 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -581,7 +581,7 @@ static int nl802154_dump_wpan_phy_parse(struct sk_buff *skb,
 		struct cfg802154_registered_device *rdev;
 		int ifidx = nla_get_u32(tb[NL802154_ATTR_IFINDEX]);
 
-		netdev = __dev_get_by_index(&init_net, ifidx);
+		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 		if (!netdev)
 			return -ENODEV;
 		if (netdev->ieee802154_ptr) {
-- 
2.34.1

Re: [PATCH wpan] ieee802154: look up the wpan_phy dump ifindex in the caller's netns

[Chandru Gopi]

Tested on v7.3-rc7 (58161ead29e5) with the one-line change from this
patch applied, in x86_64 QEMU with two mac802154_hwsim radios. phy1 is
moved into a new netns and NL802154_CMD_GET_WPAN_PHY dumps are
requested from inside it. This covers the first two rows of your table:

                                         before       with change
  ifindex of own wpan1                   ENODEV       1 phy
  ifindex of init_net wpan0              empty dump   ENODEV

The unfiltered dump and the init_net baseline are unchanged. No
warnings were printed during the netns move. I did not test the
non-wpan ifindex case or the unprivileged user cases.

Tested-by: Chandru Gopi <chandru.gopi.dev@gmail.com>

Re: [PATCH wpan] ieee802154: look up the wpan_phy dump ifindex in the caller's netns

[Miquel Raynal]

On 20/10/2026 at 14:51:25 +08, Maoyi Xie <maoyixie.tju@gmail.com> wrote:

> nl802154_dump_wpan_phy_parse() looks up NL802154_ATTR_IFINDEX in
> init_net, while the dump only returns phys in the caller's netns. For a
> caller outside init_net, the result depends on what the ifindex is in
> init_net. If no device there has it, the dump returns -ENODEV, even
> when the ifindex is one of the caller's own 802.15.4 interfaces. If an
> 802.15.4 interface there has it, the dump is empty. If any other device
> there has it, the filter is ignored and the dump returns every phy in
> the caller's netns.
>
> GET_WPAN_PHY needs no privilege, so an unprivileged process outside
> init_net can use this to tell which ifindexes exist in init_net.
>
> Look the ifindex up in sock_net(skb->sk), as nl80211_dump_wiphy_parse()
> does. Commit 66e5c2672cd1 ("ieee802154: add netns support") added the
> netns check to the dump loop. It also removed the "TODO netns" comment
> above this lookup but kept init_net.
>
> Fixes: 66e5c2672cd1 ("ieee802154: add netns support")
> Cc: stable@vger.kernel.org # v4.8+
> Assisted-by: LLM codeql
> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
> ---

Seems sensible:

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>