Re: [PATCH libftnl 00/12] more misc LLM fixes

[Phil Sutter <phil@nwl.cc>]

On Wed, Oct 28, 2026 at 03:56:20PM +0100, Florian Westphal wrote:
> Another round of LLM findings.  These commits are all unrelated,
> except that they are LLM findigs with no observed bug reports.
> 
> 1) Check mnl_nlmsg_batch_start() for a NULL return. Avoid potential NULL
> pointer dereference in src/common.
> 
> 2) Fix uninitialised attr arrays by zero-initialising tb[] arrays.
> 
> 3) Move several MNL_STRING attribute types to MNL_NUL_STRING so
> mnl_attr_validate enforces NUL termination. Harden future
> netlink-attribute parsing against non-kernel sources that may omit the
> terminator.
> 
> 4) Validate NFTA_EXPR_NAME parse success. Upgrade string validation to
> NUL_STRING, since the kernel always appends a trailing NUL.
> 
> 5) Forbid re-setting or clearing the object type field to prevent
> inconsistent state and segfaults. Check the correct subtype before freeing
> to guard against a latent union overlap crash.
> 
> 6) Drop trailing semicolon from the xfree macro. Callers already append their
> own ;, so the macro's is redundant.
> 
> 7) Remove the obsolete set_elem member from the ruleset union. Its last
> consumer (the removed json interface) no longer exists, and the shared
> nftnl_set_free path masked a latent type-confusion bug.
> 
> 8) Clear field_len array before copying to avoid reading stale values from a
> prior call. Fix a bug where shrinking the array on a second invocation
> leaks leftover field counts.
> 
> 9) Guard the s->expr_list traversal against the empty-list case to avoid
> returning a pointer into the middle of nftnl_set. Initialize data_len to 0.
> 
> 10) Fix use-after-free by calling list_del() before freeing expressions in
> set_elem. Prevents dangling next/prev pointers from corrupting a
> subsequent list_add on the same list.
> 
> 11) Clamp buf->end to the actually copied size in udata_buf_put. Prevent
> nftnl_udata_buf_space() from observing an end pointer past the buffer.
> 
> 12) Remove all remaining MNL_STRING users, switch to MNL_NUL_STRING and
> mnl_attr_put_strz. Enforce NUL-termination checking on all string
> attributes to prevent illegal strlen/strdup on unchecked data.
> 
> Florian Westphal (12):
>   src: common: mnl_nlmsg_batch_start may return NULL
>   src: fix uninitialised attr arrays
>   src: move several MNL_STRING types to MNL_NUL_STRING
>   src: expr: make sure NFTA_EXPR_NAME was parsed successfuly
>   src: object: don't permit to re-set or clear object type field
>   include: drop semicolon at end of xfree macro
>   src: ruleset: remove set_elem member from union
>   src: set: clear field_len array before copying
>   src: set: check for empty list explicitly
>   src: set_elem: list_del before freeing
>   src: udata: clamp buf->end to actally copied size
>   src: remove all remaining MNL_STRING users

Reviewed-by: Phil Sutter <phil@nwl.cc>

Thanks, Phil