Re: net: netdev-genl: NETDEV_A_NAPI_PID is the init-ns pid, not the caller's

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 15 Jun 2026 15:01:52 +0800 Maoyi Xie wrote:
> Hi all,
> 
> I noticed something in netdev_nl_napi_fill_one() and would appreciate
> your view on whether it is a real problem.
> 
> It reports the NAPI kthread pid like this:
> 
> 	if (napi->thread) {
> 		pid = task_pid_nr(napi->thread);
> 		if (nla_put_u32(rsp, NETDEV_A_NAPI_PID, pid))
> 
> task_pid_nr() returns the pid in the initial pid namespace. It is put
> into NETDEV_A_NAPI_PID without any translation to the caller's pid
> namespace.
> 
> NETDEV_CMD_NAPI_GET has no GENL_ADMIN_PERM and the family is netnsok.
> So a caller in a child pid namespace can read it. That caller then sees
> the kthread's global pid. The kthread is not in that namespace, so the
> value there should be 0.
> 
> This looks like the same case as commit 3799c2570982 ("io_uring/fdinfo:
> translate SqThread PID through caller's pid_ns").
> 
> I checked it with a small reproducer and a fix. From a child pid
> namespace the reproducer reads the kthread's global pid. With the fix it
> reads 0. I am not sure how much this matters in practice. I would
> appreciate it if you could let me know whether it is worth a fix. I am
> happy to send the patch.

Please send a patch, we should try to obey the PID namespace, indeed.