Re: [PATCH wireless] wifi: mac80211_hwsim: send config events to the radio's net namespace

[Johannes Berg]

On Sun, 2026-08-09 at 19:39 +0800, Maoyi Xie wrote:
> hwsim_mcast_config_msg() sends config notifications. Its info == NULL
> path uses genlmsg_multicast(), which delivers to init_net only. That
> path runs on an asynchronous radio destroy, from remove_user_radios() on
> a closed socket or hwsim_exit_net() on teardown.

How's any of that "where it runs" part useful?

> hwsim is per-namespace, and a radio records its namespace in wiphy_net()
> of its wiphy. A radio in a non-initial namespace therefore has its
> DEL_RADIO sent to init_net, with its id and name. An unprivileged
> listener there receives it, since the config group has no flags and
> needs no capability to join. The radio's own namespace is never told.
> 
> Send to the radio's namespace with genlmsg_multicast_netns(), using
> wiphy_net() of its wiphy, the net the GET and DUMP filters already use.
> 
> I found this with a static check for multicast that ignores the object's
> namespace. I reproduced it in a qemu VM as an unprivileged user, with no
> hardware and no kernel changes. A process creates a radio in its own
> namespace and exits. An init_net listener receives the DEL_RADIO before
> the patch, and nothing after it.
> 
> hwsim is a test driver, so the leaked metadata is low value. The fix
> still matters, since the radio's own namespace should hear about it.

etc.

Please rewrite the commit message.

> Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces")
> Cc: stable@xxxxxxxxxxxxxxx

That doesn't really seem needed.

johannes