Re: [PATCH 2/2] wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation

[Johannes Berg]

On Mon, 2026-05-04 at 20:57 +0800, Maoyi Xie wrote:
> NL80211_CMD_GET_SCAN is implemented as a multi-call dumpit. The first
> invocation of nl80211_prepare_wdev_dump() validates the requested wdev
> against the caller's netns via __cfg80211_wdev_from_attrs(). Subsequent
> invocations look up the same wiphy by global index via
> wiphy_idx_to_wiphy() and do not re-check that the wiphy is still in
> the caller's netns.
> 
> If the wiphy is moved between dumpit invocations (via
> NL80211_CMD_SET_WIPHY_NETNS), the dump silently continues to copy BSS
> list contents from the wiphy's new netns into the caller's netns
> socket buffer. The other dump paths in nl80211.c (e.g.
> nl80211_dump_wiphy() and the parallel scheduled scan dump) already
> filter by net_eq(wiphy_net(...), sock_net(skb->sk)) on every iteration.
> 
> Add the same filter to the continuation path. If the wiphy's netns no
> longer matches the caller's, return -ENODEV and the netlink dump
> machinery terminates the walk cleanly.
> 
> This is most usefully fixed alongside the SET_WIPHY_NETNS target-cap
> hardening in patch 1/2, which closes the path by which an
> unprivileged-userns caller could trigger this race themselves.
> 
> Reported-by: Maoyi Xie <maoyi.xie@xxxxxxxxxx>
> Signed-off-by: Maoyi Xie <maoyi.xie@xxxxxxxxxx>
> ---
>  net/wireless/nl80211.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index db546dd93..61b9e5eb0 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -1276,6 +1276,18 @@ static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
>  			rtnl_unlock();
>  			return -ENODEV;
>  		}
> +		/*
> +		 * The first invocation validated the wdev's netns against
> +		 * the caller via __cfg80211_wdev_from_attrs(). The wiphy
> +		 * may have moved netns between dumpit invocations (via
> +		 * NL80211_CMD_SET_WIPHY_NETNS), so re-check here. Other
> +		 * dump paths in this file (nl80211_dump_wiphy() and friends)
> +		 * already do this check on every iteration.
> +		 */

The code seems fine, but the comment saying "mirror other things" seems
a bit questionable, more about the reason why to make this change than
the static state of the code. If we think it must be unified between all
the callers, then it should probably have a common check function or so.

johannes