Re: [PATCH net-next] net: mctp: use nlmsg_payload() for netlink message data extraction

[Simon Horman <horms@kernel.org>]

On Wed, May 21, 2025 at 10:05:36AM +0800, Jeremy Kerr wrote:
> Hi Horms,
> 
> Thanks for the review!
> 
> > > --- a/net/mctp/neigh.c
> > > +++ b/net/mctp/neigh.c
> > > @@ -250,7 +250,10 @@ static int mctp_rtm_getneigh(struct sk_buff *skb, struct netlink_callback *cb)
> > >                 int idx;
> > >         } *cbctx = (void *)cb->ctx;
> > >  
> > > -       ndmsg = nlmsg_data(cb->nlh);
> > > +       ndmsg = nlmsg_payload(cb->nlh, sizeof(*ndmsg));
> > > +       if (!ndmsg)
> > > +               return -EINVAL;
> > > +
> > 
> > But is this one a bug fix?
> 
> At the moment, we cannot hit the case where the nlh does not contain a
> full ndmsg, as the core handler (net/core/neighbour.c, neigh_get()) has
> already validated the size (through neigh_valid_req_get()), and would
> have failed the get before the MCTP hander is called.
> 
> However, relying on that is a bit fragile, hence applying the
> nlmsg_payload replacement here.
> 
> I'm happy to split it out if that makes more sense though; in which case
> this change would be initially implemented as check on ->nlmsg_len (in
> order to be backportable to stable), and then a subsequent rework to use
> nlmsg_payload. Let me know what would work best.

Hi Jeremy,

Thanks for the explanation. I think it might be best to add some commentary
to the commit message, as this was not obvious to me. But I don't feel
strongly about this.

So either way, this patch now looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>