[PATCH v2] net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

[PATCH v2] net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

[Quentin Armitage]

Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly") changed
inet_validate_link_af() to call nla_parse_nested() rather than
nla_for_each_nested() for IFLA_INET_CONF. A side effect of this change is that
the code now checks that NLA_F_NESTED is set for IFLA_INET_CONF, and rejects the
message if it is not, whereas previously there was no check for NLA_F_NESTED
being set.

The consequence of this is that code which worked prior to Linux 7.1, albeit
erroneously not setting NLA_F_NESTED now fails.

In order to maintain backward compatibility, rather than calling
nla_parse_nested(), nla_parse() is called.

From 498a8cffcdbbc3265d2a4747ba5ded6f562af3a7 Mon Sep 17 00:00:00 2001
From: Quentin Armitage <quentin@armitage.org.uk>
Date: Mon, 14 Sep 2026 18:19:53 +0100
Subject: [PATCH v2] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset

Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
added validation of IFLA_INET_CONF attributes, and in the process
changed the call of nla_for_each_nested() to nla_parse_nested(). A
side effect of this change is that the IFLA_INET_CONF option is now
tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
commit there was no check of NLA_F_NESTED.

Change nla_parse_nested() to nla_parse(). This restores the previous
functionality of not checking NLA_F_NESTED, thereby allowing code that
(incorrectly) doesn't set NLA_F_NESTED to continue to work.

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
---
 net/ipv4/devinet.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a90be57c63be..5b6b11c943e4 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2117,9 +2117,10 @@ static int inet_validate_link_af(const struct net_device
*dev,
 		return err;
 
 	if (tb[IFLA_INET_CONF]) {
-		err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX,
-				       tb[IFLA_INET_CONF], inet_devconf_policy,
-				       extack);
+		err = nla_parse(nested_tb, IPV4_DEVCONF_MAX,
+				nla_data(tb[IFLA_INET_CONF]),
+				nla_len(tb[IFLA_INET_CONF]),
+				inet_devconf_policy, extack);
 
 		if (err < 0)
 			return err;
-- 
2.55.0

Re: [PATCH v2] net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

[Ido Schimmel]

On Mon, Sep 14, 2026 at 08:02:07PM +0100, Quentin Armitage wrote:
> Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly") changed
> inet_validate_link_af() to call nla_parse_nested() rather than
> nla_for_each_nested() for IFLA_INET_CONF. A side effect of this change is that
> the code now checks that NLA_F_NESTED is set for IFLA_INET_CONF, and rejects the
> message if it is not, whereas previously there was no check for NLA_F_NESTED
> being set.
> 
> The consequence of this is that code which worked prior to Linux 7.1, albeit
> erroneously not setting NLA_F_NESTED now fails.
> 
> In order to maintain backward compatibility, rather than calling
> nla_parse_nested(), nla_parse() is called.
> 
> From 498a8cffcdbbc3265d2a4747ba5ded6f562af3a7 Mon Sep 17 00:00:00 2001
> From: Quentin Armitage <quentin@armitage.org.uk>
> Date: Mon, 14 Sep 2026 18:19:53 +0100
> Subject: [PATCH v2] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
> 
> Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
> added validation of IFLA_INET_CONF attributes, and in the process
> changed the call of nla_for_each_nested() to nla_parse_nested(). A
> side effect of this change is that the IFLA_INET_CONF option is now
> tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
> commit there was no check of NLA_F_NESTED.
> 
> Change nla_parse_nested() to nla_parse(). This restores the previous
> functionality of not checking NLA_F_NESTED, thereby allowing code that
> (incorrectly) doesn't set NLA_F_NESTED to continue to work.
> 
> Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>

1. The code looks fine, but the patch is corrupted and cannot be
applied:

$ b4 shazam 24158a1c7c9d7fc28d42a0be53f3b9d1919caa1b.camel@armitage.org.uk
[...]
Applying: net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set
Patch failed at 0001 net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set
error: corrupt patch at /home/idosch/code/linux/.git/rebase-apply/patch:10

2. Missing a Fixes tag just above your SoB:

Fixes: fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")

3. Since Jakub asked, please mention in the commit message that this
change broke keepalived.

4. See more info about how to correctly format a patch here:

https://docs.kernel.org/next/process/maintainer-netdev.html
https://docs.kernel.org/next/process/submitting-patches.html

[PATCH v3] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset

[Quentin Armitage]

Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
added validation of IFLA_INET_CONF attributes, and in the process
changed the call of nla_for_each_nested() to nla_parse_nested(). A
side effect of this change is that the IFLA_INET_CONF option is now
tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
commit there was no check of NLA_F_NESTED.

Change nla_parse_nested() to nla_parse(). This restores the previous
functionality of not checking NLA_F_NESTED, thereby allowing code that
(incorrectly) doesn't set NLA_F_NESTED to continue to work.

This issue was identified because keepalived started logging errors when
it was configuring macvlans that it created.

Fixes: fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
---
 net/ipv4/devinet.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a90be57c63be..5b6b11c943e4 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2117,9 +2117,10 @@ static int inet_validate_link_af(const struct net_device *dev,
 		return err;
 
 	if (tb[IFLA_INET_CONF]) {
-		err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX,
-				       tb[IFLA_INET_CONF], inet_devconf_policy,
-				       extack);
+		err = nla_parse(nested_tb, IPV4_DEVCONF_MAX,
+				nla_data(tb[IFLA_INET_CONF]),
+				nla_len(tb[IFLA_INET_CONF]),
+				inet_devconf_policy, extack);
 
 		if (err < 0)
 			return err;
-- 
2.55.0

Re: [PATCH v3] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset

[Ido Schimmel]

On Tue, Sep 15, 2026 at 10:33:21PM +0100, Quentin Armitage wrote:
> Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
> added validation of IFLA_INET_CONF attributes, and in the process
> changed the call of nla_for_each_nested() to nla_parse_nested(). A
> side effect of this change is that the IFLA_INET_CONF option is now
> tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
> commit there was no check of NLA_F_NESTED.
> 
> Change nla_parse_nested() to nla_parse(). This restores the previous
> functionality of not checking NLA_F_NESTED, thereby allowing code that
> (incorrectly) doesn't set NLA_F_NESTED to continue to work.
> 
> This issue was identified because keepalived started logging errors when
> it was configuring macvlans that it created.
> 
> Fixes: fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
> 
> Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>

For next time (assuming there won't be v4):

1. No blank line between Fixes tag and SoB.

2. Specify the target tree in subject prefix.
   In this case: [PATCH net v3]

3. Post as separate thread, not as a reply.

4. Use scripts/get_maintainer.pl to get the list of recipients.

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH v3] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 15 Sep 2026 22:33:21 +0100 you wrote:
> Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")
> added validation of IFLA_INET_CONF attributes, and in the process
> changed the call of nla_for_each_nested() to nla_parse_nested(). A
> side effect of this change is that the IFLA_INET_CONF option is now
> tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
> commit there was no check of NLA_F_NESTED.
> 
> [...]

Here is the summary with links:
  - [v3] net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
    https://git.kernel.org/netdev/net/c/6c096bb08de9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html