[PATCH net-next] net: netlink: recommend policy range validation

[PATCH net-next] net: netlink: recommend policy range validation

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

For large ranges (outside of s16) the documentation currently
recommends open-coding the validation, but it's better to use
the NLA_POLICY_FULL_RANGE() or NLA_POLICY_FULL_RANGE_SIGNED()
policy validation instead; recommend that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 include/net/netlink.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/net/netlink.h b/include/net/netlink.h
index 6e1e670e06bc..b12cd957abb4 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -276,7 +276,8 @@ enum nla_policy_validation {
  *                         Note that in the interest of code simplicity and
  *                         struct size both limits are s16, so you cannot
  *                         enforce a range that doesn't fall within the range
- *                         of s16 - do that as usual in the code instead.
+ *                         of s16 - do that using the NLA_POLICY_FULL_RANGE()
+ *                         or NLA_POLICY_FULL_RANGE_SIGNED() macros instead.
  *                         Use the NLA_POLICY_MIN(), NLA_POLICY_MAX() and
  *                         NLA_POLICY_RANGE() macros.
  *    NLA_U8,
-- 
2.39.1

Re: [PATCH net-next] net: netlink: recommend policy range validation

[Ido Schimmel]

On Fri, Jan 27, 2023 at 08:45:06AM +0100, Johannes Berg wrote:
> From: Johannes Berg <johannes.berg@intel.com>
> 
> For large ranges (outside of s16) the documentation currently
> recommends open-coding the validation, but it's better to use
> the NLA_POLICY_FULL_RANGE() or NLA_POLICY_FULL_RANGE_SIGNED()
> policy validation instead; recommend that.
> 
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>

I followed the current comment in code I'm currently working on to
validate VXLAN VNI ([0, 16M - 1]). Adjusted to use
NLA_POLICY_FULL_RANGE() following your patch, so thanks for that.

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH net-next] net: netlink: recommend policy range validation

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 27 Jan 2023 08:45:06 +0100 you wrote:
> From: Johannes Berg <johannes.berg@intel.com>
> 
> For large ranges (outside of s16) the documentation currently
> recommends open-coding the validation, but it's better to use
> the NLA_POLICY_FULL_RANGE() or NLA_POLICY_FULL_RANGE_SIGNED()
> policy validation instead; recommend that.
> 
> [...]

Here is the summary with links:
  - [net-next] net: netlink: recommend policy range validation
    https://git.kernel.org/netdev/net-next/c/70eb3911d80f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html