superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

netlink: add a nla_nest_end_safe() helper 

The nla_len field in struct nlattr is a __u16, which can only hold
values up to 65535. If a nested attribute grows beyond this limit,
nla_nest_end() silently truncates the length, producing a corrupted
netlink message with no indication of the problem.

Since nla_nest_end() is used everywhere and this issue rarely happens,
let's add a new helper to check the length.

Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-4-7623a5e8f70b@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
master
Hangbin Liu 2026-04-08 15:08:52 +08:00 committed by Jakub Kicinski
parent 594ba44771
commit 1346586a9a
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
include/net/netlink.h
View File

@ -2264,6 +2264,25 @@ static inline int nla_nest_end(struct sk_buff *skb, struct nlattr *start)
return skb->len;
}
/**
* nla_nest_end_safe - Validate and finalize nesting of attributes
* @skb: socket buffer the attributes are stored in
* @start: container attribute
*
* Corrects the container attribute header to include all appended
* attributes.
*
* Returns: the total data length of the skb, or -EMSGSIZE if the
* nested attribute length exceeds U16_MAX.
*/
static inline int nla_nest_end_safe(struct sk_buff *skb, struct nlattr *start)
{
if (skb_tail_pointer(skb) - (unsigned char *)start > U16_MAX)
return -EMSGSIZE;
return nla_nest_end(skb, start);
}
/**
* nla_nest_cancel - Cancel nesting of attributes
* @skb: socket buffer the message is stored in