nl802154: GET_WPAN_PHY dump resolves NL802154_ATTR_IFINDEX in init_net

nl802154: GET_WPAN_PHY dump resolves NL802154_ATTR_IFINDEX in init_net

[Maoyi Xie]

Hi all,

I think nl802154_dump_wpan_phy_parse() looks up NL802154_ATTR_IFINDEX in
init_net rather than in the caller's network namespace. I would
appreciate it if you could take a look.

The lookup is (net/ieee802154/nl802154.c:584 in 7.1-rc1):

	netdev = __dev_get_by_index(&init_net, ifidx);

The dump loop below it filters phys by sock_net(skb->sk).

It looks like the same kind of gap as commit 79240f3f6d76 ("wifi:
nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump()
continuation"), where a dump looked the wiphy up by its global index
without checking the caller's netns.

I found this with a CodeQL check for lookups done in init_net. I
reproduced it on 7.1-rc1 in qemu with two mac802154_hwsim radios and
phy1 moved into a netns. The reproduction needed no kernel changes. I do
not have real 802.15.4 hardware. From inside that netns, as an
unprivileged user, a GET_WPAN_PHY dump with NL802154_ATTR_IFINDEX set to
its own wpan1 returns ENODEV. The same dump with init_net's wpan0
ifindex, which does not exist in that netns, returns an empty dump
instead of ENODEV.

nl80211_dump_wiphy_parse() does the same lookup with sock_net(skb->sk).
With sock_net(skb->sk) in place of &init_net on the quoted line, the
dump with wpan1 returns phy1 and the dump with wpan0 returns ENODEV. The
tree has no wpan selftest.

Does this look like a real bug? If it does, I am happy to send a patch,
or to leave the fix to you.

Thanks,
Maoyi

Re: nl802154: GET_WPAN_PHY dump resolves NL802154_ATTR_IFINDEX in init_net

[Chandru Gopi]

On Mon, 21 Sep 2026 00:50:57 +0800, Maoyi Xie wrote:
> Does this look like a real bug? If it does, I am happy to send a patch,
> or to leave the fix to you.

Yes, I can reproduce it on v7.3-rc7 (58161ead29e5, Oct 16 2026) in
x86_64 QEMU with two mac802154_hwsim radios. The lookup at
net/ieee802154/nl802154.c:584 is unchanged, and I did not see a fix on
the list or in mainline as of today.

Setup: wpan0 on phy0 and wpan1 on phy1, both in init_net. phy1 is moved
into a fresh netns with "iwpan phy phy1 set netns <pid>". From inside
that netns I send NL802154_CMD_GET_WPAN_PHY dumps:

                                          before        after
  no ifindex filter                       1 phy         1 phy
  ifindex of wpan1 (in this netns)        ENODEV        1 phy
  ifindex of wpan0 (only in init_net)     empty dump    ENODEV

"after" is with __dev_get_by_index(&init_net, ifidx) replaced by
__dev_get_by_index(sock_net(skb->sk), ifidx), as you suggested. Both
cases now return what you described, and the init_net baseline is
unchanged. No warnings were printed during the netns move.

I used a short static C program with raw generic netlink for this. I
am happy to turn it into a hwsim-based selftest, and can put it
wherever you think it belongs.

Are you still planning to send the fix? I can send it, with you as
Reported-by, or send the selftest alongside yours, whichever you
prefer.

Thanks,
Chandru