From: Linkui Xiao <xiaolinkui@126.com>
To: dsahern@kernel.org, idosch@nvidia.com, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
horms@kernel.org, tgraf@suug.ch
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Linkui Xiao <xiaolinkui@kylinos.cn>
Subject: [PATCH] net: fib_rules: add FRA_GOTO and FRA_L3MDEV to fib_rule_nlmsg_size()
Date: Fri, 11 Sep 2026 15:12:41 +0800 [thread overview]
Message-ID: <20260911071241.2701784-1-xiaolinkui@126.com> (raw)
From: Linkui Xiao <xiaolinkui@kylinos.cn>
fib_nl_fill_rule() emits FRA_GOTO and FRA_L3MDEV, but
fib_rule_nlmsg_size() reserves room for neither. Its only caller,
notify_rule_change(), allocates the notification skb with that size and
treats a failure as a bug:
/* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
A rule that has both a goto target and l3mdev set needs 16 more bytes
than are reserved. nlmsg_new() rounds the allocation up through
SKB_DATA_ALIGN(), so the slack hides the mistake most of the time and
the bug stays latent, but the accounting is wrong and the notification
can still fail with -EMSGSIZE.
Reserve the two missing attributes, keeping the order used by
fib_nl_fill_rule().
Fixes: 0947c9fe56d9 ("[NET] fib_rules: goto rule action")
Fixes: 96c63fa7393d ("net: Add l3mdev rule")
Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
---
net/core/fib_rules.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 7df216c17c67..5e84bc740191 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -1133,7 +1133,9 @@ static inline size_t fib_rule_nlmsg_size(struct fib_rules_ops *ops,
+ nla_total_size(4) /* FRA_SUPPRESS_IFGROUP */
+ nla_total_size(4) /* FRA_FWMARK */
+ nla_total_size(4) /* FRA_FWMASK */
+ + nla_total_size(4) /* FRA_GOTO */
+ nla_total_size_64bit(8) /* FRA_TUN_ID */
+ + nla_total_size(1) /* FRA_L3MDEV */
+ nla_total_size(sizeof(struct fib_kuid_range))
+ nla_total_size(1) /* FRA_PROTOCOL */
+ nla_total_size(1) /* FRA_IP_PROTO */
--
2.25.1
next reply other threads:[~2026-09-11 7:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-11 7:12 Linkui Xiao [this message]
2026-09-13 1:06 ` [PATCH] net: fib_rules: add FRA_GOTO and FRA_L3MDEV to fib_rule_nlmsg_size() David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260911071241.2701784-1-xiaolinkui@126.com \
--to=xiaolinkui@126.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=tgraf@suug.ch \
--cc=xiaolinkui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.