nl802154: GET_WPAN_PHY dump resolves NL802154_ATTR_IFINDEX in init_net

nl802154: GET_WPAN_PHY dump resolves NL802154_ATTR_IFINDEX in init_net

[Maoyi Xie]

Hi all,

I think nl802154_dump_wpan_phy_parse() looks up NL802154_ATTR_IFINDEX in
init_net rather than in the caller's network namespace. I would
appreciate it if you could take a look.

The lookup is (net/ieee802154/nl802154.c:584 in 7.1-rc1):

	netdev = __dev_get_by_index(&init_net, ifidx);

The dump loop below it filters phys by sock_net(skb->sk).

It looks like the same kind of gap as commit 79240f3f6d76 ("wifi:
nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump()
continuation"), where a dump looked the wiphy up by its global index
without checking the caller's netns.

I found this with a CodeQL check for lookups done in init_net. I
reproduced it on 7.1-rc1 in qemu with two mac802154_hwsim radios and
phy1 moved into a netns. The reproduction needed no kernel changes. I do
not have real 802.15.4 hardware. From inside that netns, as an
unprivileged user, a GET_WPAN_PHY dump with NL802154_ATTR_IFINDEX set to
its own wpan1 returns ENODEV. The same dump with init_net's wpan0
ifindex, which does not exist in that netns, returns an empty dump
instead of ENODEV.

nl80211_dump_wiphy_parse() does the same lookup with sock_net(skb->sk).
With sock_net(skb->sk) in place of &init_net on the quoted line, the
dump with wpan1 returns phy1 and the dump with wpan0 returns ENODEV. The
tree has no wpan selftest.

Does this look like a real bug? If it does, I am happy to send a patch,
or to leave the fix to you.

Thanks,
Maoyi