[PATCH net] ipv4: igmp: report IFA_TARGET_NETNSID in multicast address dumps

[PATCH net] ipv4: igmp: report IFA_TARGET_NETNSID in multicast address dumps

[Wenbo Sun]

Commit eb4e17a1d915 ("netlink: support dumping IPv4 multicast addresses")
extended RTM_GETMULTICAST to support dumping IPv4 multicast addresses.
While inet_valid_dump_ifaddr_req() accepts IFA_TARGET_NETNSID in dump
requests and dumps addresses from the target network namespace,
inet_fill_ifmcaddr() never puts IFA_TARGET_NETNSID in the netlink
replies.

As a result, userspace applications querying multicast addresses in a
target netns receive entries without IFA_TARGET_NETNSID, which may lead
them to conclude that the kernel does not support netns-targeted dumps
or to misattribute the returned addresses. In contrast, IPv4 unicast
address dumps (inet_fill_ifaddr()), IPv6 multicast address dumps
(inet6_fill_ifmcaddr()), and AF_PACKET multicast address dumps all
report IFA_TARGET_NETNSID.

Add IFA_TARGET_NETNSID to inet_fill_ifmcaddr() when requested, and
explicitly set fillargs.netnsid = -1 in inet_ifmcaddr_notify() to
prevent notification messages from exceeding their preallocated skb
size.

This issue was identified with the assistance of an LLM-based code
review tool, confirmed by reproducing in a User-Mode Linux (UML)
environment where AF_INET RTM_GETMULTICAST dumps with IFA_TARGET_NETNSID
omitted the attribute, and verified in UML that AF_INET multicast dumps
now report IFA_TARGET_NETNSID, normal dumps without netnsid continue to
work, and socket multicast join/leave notifications succeed without
warning.

Fixes: eb4e17a1d915 ("netlink: support dumping IPv4 multicast addresses")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 net/ipv4/igmp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 144fca158adc..831d003677ba 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1517,6 +1517,12 @@ int inet_fill_ifmcaddr(struct sk_buff *skb, struct net_device *dev,
 	ifm->ifa_scope = RT_SCOPE_UNIVERSE;
 	ifm->ifa_index = dev->ifindex;
 
+	if (args->netnsid >= 0 &&
+	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
+		nlmsg_cancel(skb, nlh);
+		return -EMSGSIZE;
+	}
+
 	ci.cstamp = (READ_ONCE(im->mca_cstamp) - INITIAL_JIFFIES) * 100UL / HZ;
 	ci.tstamp = ci.cstamp;
 	ci.ifa_prefered = INFINITY_LIFE_TIME;
@@ -1538,6 +1544,7 @@ static void inet_ifmcaddr_notify(struct net_device *dev,
 {
 	struct inet_fill_args fillargs = {
 		.event = event,
+		.netnsid = -1,
 	};
 	struct net *net = dev_net(dev);
 	struct sk_buff *skb;
-- 
2.33.0

Re: [PATCH net] ipv4: igmp: report IFA_TARGET_NETNSID in multicast address dumps

[Hangbin Liu]

On Wed, Nov 11, 2026 at 04:22:22PM +0800, Wenbo Sun wrote:
> Commit eb4e17a1d915 ("netlink: support dumping IPv4 multicast addresses")
> extended RTM_GETMULTICAST to support dumping IPv4 multicast addresses.
> While inet_valid_dump_ifaddr_req() accepts IFA_TARGET_NETNSID in dump
> requests and dumps addresses from the target network namespace,
> inet_fill_ifmcaddr() never puts IFA_TARGET_NETNSID in the netlink
> replies.
> 
> As a result, userspace applications querying multicast addresses in a
> target netns receive entries without IFA_TARGET_NETNSID, which may lead
> them to conclude that the kernel does not support netns-targeted dumps
> or to misattribute the returned addresses. In contrast, IPv4 unicast
> address dumps (inet_fill_ifaddr()), IPv6 multicast address dumps
> (inet6_fill_ifmcaddr()), and AF_PACKET multicast address dumps all
> report IFA_TARGET_NETNSID.
> 
> Add IFA_TARGET_NETNSID to inet_fill_ifmcaddr() when requested, and
> explicitly set fillargs.netnsid = -1 in inet_ifmcaddr_notify() to
> prevent notification messages from exceeding their preallocated skb
> size.
> 
> This issue was identified with the assistance of an LLM-based code
> review tool, confirmed by reproducing in a User-Mode Linux (UML)
> environment where AF_INET RTM_GETMULTICAST dumps with IFA_TARGET_NETNSID
> omitted the attribute, and verified in UML that AF_INET multicast dumps
> now report IFA_TARGET_NETNSID, normal dumps without netnsid continue to
> work, and socket multicast join/leave notifications succeed without
> warning.
> 
> Fixes: eb4e17a1d915 ("netlink: support dumping IPv4 multicast addresses")

I don't think this should be fix. Maybe consider this as a new feature and
target to net-next?

Thanks
Hangbin
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
> ---
>  net/ipv4/igmp.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
> index 144fca158adc..831d003677ba 100644
> --- a/net/ipv4/igmp.c
> +++ b/net/ipv4/igmp.c
> @@ -1517,6 +1517,12 @@ int inet_fill_ifmcaddr(struct sk_buff *skb, struct net_device *dev,
>  	ifm->ifa_scope = RT_SCOPE_UNIVERSE;
>  	ifm->ifa_index = dev->ifindex;
>  
> +	if (args->netnsid >= 0 &&
> +	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
> +		nlmsg_cancel(skb, nlh);
> +		return -EMSGSIZE;
> +	}
> +
>  	ci.cstamp = (READ_ONCE(im->mca_cstamp) - INITIAL_JIFFIES) * 100UL / HZ;
>  	ci.tstamp = ci.cstamp;
>  	ci.ifa_prefered = INFINITY_LIFE_TIME;
> @@ -1538,6 +1544,7 @@ static void inet_ifmcaddr_notify(struct net_device *dev,
>  {
>  	struct inet_fill_args fillargs = {
>  		.event = event,
> +		.netnsid = -1,
>  	};
>  	struct net *net = dev_net(dev);
>  	struct sk_buff *skb;
> -- 
> 2.33.0
>