Re: [PATCH 04/15] device core: Introduce "device evidence" over netlink

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Premature state advancement causes missing netlink attributes when a dump message is split across multiple skbs.
--

commit 011b819de43e88cfea717a04a2344bfd9d08116a
Author: Dan Williams <djbw@kernel.org>

device core: Introduce "device evidence" over netlink

This commit introduces a device-scoped ABI over netlink to retrieve device
security evidence objects, such as SPDM certificates and measurements. A
bus opts in via device_evidence_register() to resolve a device handle to
its evidence context and provide these objects to userspace.

> diff --git a/drivers/base/evidence.c b/drivers/base/evidence.c
> new file mode 100644
> index 0000000000000..8e019669db072
> --- /dev/null
> +++ b/drivers/base/evidence.c
[ ... ]
> +static int __device_evidence_read(struct sk_buff *skb,
> +				  struct netlink_callback *cb,
> +				  struct device_evidence *evidence)
> +{
[ ... ]
> +	if (ctx->offset == DEVICE_EVIDENCE_OBJECT_START) {
> +		if (nla_put_u32(skb, DEVICE_EVIDENCE_A_OBJECT_TYPE,
> +				current_type(ctx)) ||
> +		    nla_put_u32(skb, DEVICE_EVIDENCE_A_OBJECT_GENERATION,
> +				ctx->generation) ||
> +		    nla_put_u32(skb, DEVICE_EVIDENCE_A_OBJECT_LENGTH,
> +				object_len))
> +			goto out_cancel;
> +
> +		ctx->offset = 0;
> +	}
> +
> +	available = skb_tailroom(skb);
> +	overhead = nla_total_size(0) + NLA_ALIGNTO;
> +	if (available <= overhead) {
> +		rc = -EMSGSIZE;
> +		goto out_cancel;
> +	}

[Severity: Medium]
If available <= overhead evaluates to true and the code takes the
goto out_cancel path, does ctx->offset incorrectly remain 0 while the
netlink message is canceled?

On the next invocation with a fresh skb, ctx->offset will not equal
DEVICE_EVIDENCE_OBJECT_START, which means the mandatory type, generation,
and length attributes will be skipped, leading to a malformed netlink reply.

Could ctx->offset be updated after the tailroom check or reverted in the
out_cancel error path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260705220819.2472765-1-djbw@kernel.org?part=4