[PATCH wpan] ieee802154: look up the wpan_phy dump ifindex in the caller's netns

[Maoyi Xie <maoyixie.tju@gmail.com>]

nl802154_dump_wpan_phy_parse() looks up NL802154_ATTR_IFINDEX in
init_net, while the dump only returns phys in the caller's netns. For a
caller outside init_net, the result depends on what the ifindex is in
init_net. If no device there has it, the dump returns -ENODEV, even
when the ifindex is one of the caller's own 802.15.4 interfaces. If an
802.15.4 interface there has it, the dump is empty. If any other device
there has it, the filter is ignored and the dump returns every phy in
the caller's netns.

GET_WPAN_PHY needs no privilege, so an unprivileged process outside
init_net can use this to tell which ifindexes exist in init_net.

Look the ifindex up in sock_net(skb->sk), as nl80211_dump_wiphy_parse()
does. Commit 66e5c2672cd1 ("ieee802154: add netns support") added the
netns check to the dump loop. It also removed the "TODO netns" comment
above this lookup but kept init_net.

Fixes: 66e5c2672cd1 ("ieee802154: add netns support")
Cc: stable@vger.kernel.org # v4.8+
Assisted-by: LLM codeql
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
I asked about this on linux-wpan and netdev in September [1].

Found with a CodeQL check for lookups done in init_net. Tested on an
unmodified v7.3 and on v7.3 with this patch, in qemu with two
mac802154_hwsim radios and phy1 moved into netns ns1. Not tested on
real 802.15.4 hardware. Dumps from ns1, filtered by ifindex:

  ifindex in the filter                     before fix   with fix
  4: wpan1 in ns1, unused in init_net       -ENODEV      phy1
  3: wpan0 in init_net, unused in ns1       empty        -ENODEV
  5: sit0 in init_net, unused in ns1        phy1         -ENODEV
  3: wpan0 in init_net, new wpan2 in ns1    empty        phy1

Rows 1 to 3 give the same results for uid 65534 in ns1. For uid 65534
in its own user and net namespace, which has no phy, ifindex 3 and 5
return an empty dump before the fix and -ENODEV with it. Unfiltered
dumps and dumps from init_net do not change.

[1] https://lore.kernel.org/all/20260920165057.3753458-1-maoyixie.tju@gmail.com/

 net/ieee802154/nl802154.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 115f43d0e158..fae5c413fa60 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -581,7 +581,7 @@ static int nl802154_dump_wpan_phy_parse(struct sk_buff *skb,
 		struct cfg802154_registered_device *rdev;
 		int ifidx = nla_get_u32(tb[NL802154_ATTR_IFINDEX]);
 
-		netdev = __dev_get_by_index(&init_net, ifidx);
+		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 		if (!netdev)
 			return -ENODEV;
 		if (netdev->ieee802154_ptr) {
-- 
2.34.1