Re: [PATCH net-next v2 10/10] NFSD: Add allow_tags to the netlink export interface

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] nfsd: NLA_STRING policy in fs/nfsd/netlink.c disagrees with
  nfsd.yaml
--

commit 1059c4281c80865b99ac7732d9133036256073b9
Author: Chuck Lever <cel@kernel.org>

NFSD: Add allow_tags to the netlink export interface

This commit adds the allow-tags attribute to the NFSD netlink svc-export
attribute set and parses it in nfsd_nl_parse_one_export() to enforce mTLS
session tag policies.

> diff --git a/Documentation/netlink/specs/nfsd.yaml b/Documentation/netlink/specs/nfsd.yaml
> index 9ae37bf3ea717..e58856b34b020 100644
> --- a/Documentation/netlink/specs/nfsd.yaml
> +++ b/Documentation/netlink/specs/nfsd.yaml

[ ... ]

> @@ -297,6 +301,12 @@ attribute-sets:
>        -
>          name: fsid
>          type: s32
> +      -
> +        name: allow-tags
> +        type: string
> +        checks:
> +          max-len: handshake-session-tag-max-len
> +        multi-attr: true
>    -
>      name: svc-export-reqs
>      attributes:

[ ... ]

> diff --git a/fs/nfsd/netlink.c b/fs/nfsd/netlink.c
> index 88a4a4ffcb7fd..146c655757410 100644
> --- a/fs/nfsd/netlink.c
> +++ b/fs/nfsd/netlink.c

[ ... ]

> @@ -41,7 +42,7 @@ const struct nla_policy nfsd_sock_nl_policy[NFSD_A_SOCK_TRANSPORT_NAME + 1] = {
>  	[NFSD_A_SOCK_TRANSPORT_NAME] = { .type = NLA_NUL_STRING, },
>  };
>  
> -const struct nla_policy nfsd_svc_export_nl_policy[NFSD_A_SVC_EXPORT_FSID + 1] = {
> +const struct nla_policy nfsd_svc_export_nl_policy[NFSD_A_SVC_EXPORT_ALLOW_TAGS + 1] = {
>  	[NFSD_A_SVC_EXPORT_SEQNO] = { .type = NLA_U64, },
>  	[NFSD_A_SVC_EXPORT_CLIENT] = { .type = NLA_NUL_STRING, },
>  	[NFSD_A_SVC_EXPORT_PATH] = { .type = NLA_NUL_STRING, },
> @@ -55,6 +56,7 @@ const struct nla_policy nfsd_svc_export_nl_policy[NFSD_A_SVC_EXPORT_FSID + 1] =
>  	[NFSD_A_SVC_EXPORT_XPRTSEC] = NLA_POLICY_MASK(NLA_U32, 0x7),
>  	[NFSD_A_SVC_EXPORT_FLAGS] = NLA_POLICY_MASK(NLA_U32, 0x3ffff),
>  	[NFSD_A_SVC_EXPORT_FSID] = { .type = NLA_S32, },
> +	[NFSD_A_SVC_EXPORT_ALLOW_TAGS] = { .type = NLA_STRING, .len = HANDSHAKE_SESSION_TAG_MAX_LEN, },
>  };

[Severity: Medium]
Was fs/nfsd/netlink.c edited by hand to use NLA_STRING for
NFSD_A_SVC_EXPORT_ALLOW_TAGS?

fs/nfsd/netlink.c is generated from Documentation/netlink/specs/nfsd.yaml,
where allow-tags is a genetlink string attribute without unterminated-ok.
Running tools/net/ynl/ynl-regen.sh will overwrite this entry with
.type = NLA_NUL_STRING, changing the kernel attribute validation policy on
the next regeneration.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-tls-session-tags-v2-0-a587a50de7fc@kernel.org?part=10