Re: [PATCH net-next v2 2/2] net: bridge: fail link info that does not fit the IFLA_AF_SPEC nest

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] br_info_notify() propagates -E2BIG to rtnl_set_sk_err(), bypassing NETLINK_NO_ENOBUFS and breaking listeners.
--

commit 9b1aaa64ff49b7a437b098d6d662cc77e1219f4b
Author: Artem Lytkin <iprintercanon@gmail.com>

net: bridge: fail link info that does not fit the IFLA_AF_SPEC nest

br_fill_ifinfo() puts all of a port's VLAN, tunnel and MST entries into
one nest, and nla_len is a u16, so a large enough port produces a nest
whose length wraps and userspace reads garbage.

Cancel the message and return -E2BIG with an extack pointing at
RTM_GETVLAN instead. The dump retries the port with an empty skb and
the error goes to userspace; notifications reach rtnl_set_sk_err() and
listeners resync. Not -EMSGSIZE, since no bigger buffer would help.

> diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
> index 855a46aec3a89..53676df9e4d11 100644
> --- a/net/bridge/br_netlink.c
> +++ b/net/bridge/br_netlink.c
[ ... ]
> @@ -654,7 +660,8 @@ void br_info_notify(int event, const struct net_bridge *br,
>  	if (skb == NULL)
>  		goto errout;
>  
> -	err = br_fill_ifinfo(skb, port, 0, 0, event, 0, filter, dev, false);
> +	err = br_fill_ifinfo(skb, port, 0, 0, event, 0, filter, dev, false,
> +			     NULL);
>  	if (err < 0) {
>  		/* -EMSGSIZE implies BUG in br_nlmsg_size() */
>  		WARN_ON(err == -EMSGSIZE);

[Severity: High]
The commit message states "notifications reach rtnl_set_sk_err() and
listeners resync." Could this approach introduce a regression where -E2BIG
is broadcasted to netlink listeners instead of being filtered?

When br_fill_ifinfo() returns -E2BIG due to adding many VLANs to a bridge
port, br_info_notify() will jump to the errout label and pass the error to
rtnl_set_sk_err():

errout:
	rtnl_set_sk_err(net, RTNLGRP_LINK, err);

Passing -E2BIG here bypasses the NETLINK_NO_ENOBUFS socket option which
only filters ENOBUFS. Will this unhandled E2BIG error cause network
management daemons to crash or drop connections?

Might this lead to a system-wide denial of service if unprivileged users
trigger this path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912135022.1701-1-iprintercanon@gmail.com?part=2