[PATCH net-next 0/9] net: Introduce nlmsg_payload helper

[PATCH net-next 0/9] net: Introduce nlmsg_payload helper

[Breno Leitao]

In the current codebase, there are multiple instances where the
structure size is checked before assigning it to a Netlink message. This
check is crucial for ensuring that the structure is correctly mapped
onto the Netlink message, providing a layer of security.

To streamline this process, Jakub Kicinski suggested creating a helper
function, `nlmsg_payload`, which verifies if the structure fits within
the message. If it does, the function returns the data; otherwise, it
returns NULL. This approach simplifies the code and reduces redundancy.

This patchset introduces the `nlmsg_payload` helper and updates several
parts of the code to use it. Further updates will follow in subsequent
patchsets.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (9):
      netlink: Introduce nlmsg_payload helper
      neighbour: Use nlmsg_payload in neightbl_valid_dump_info
      neighbour: Use nlmsg_payload in neigh_valid_get_req
      rtnetlink: Use nlmsg_payload in valid_fdb_dump_strict
      mpls: Use nlmsg_payload in mpls_valid_fib_dump_req
      ipv6: Use nlmsg_payload in inet6_valid_dump_ifaddr_req
      ipv6: Use nlmsg_payload in inet6_rtm_valid_getaddr_req
      mpls: Use nlmsg_payload in mpls_valid_getroute_req
      net: fib_rules: Use nlmsg_payload in fib_valid_dumprule_req

 include/net/netlink.h | 13 +++++++++++++
 net/core/fib_rules.c  |  4 ++--
 net/core/neighbour.c  |  8 ++++----
 net/core/rtnetlink.c  |  4 ++--
 net/ipv6/addrconf.c   |  8 ++++----
 net/mpls/af_mpls.c    |  8 ++++----
 6 files changed, 29 insertions(+), 16 deletions(-)
---
base-commit: 0c49baf099ba2147a6ff3bbdc3197c6ddbee5469
change-id: 20250411-nlmsg-2dd8c30ba35c

Best regards,
-- 
Breno Leitao <leitao@debian.org>

[PATCH net-next 1/9] netlink: Introduce nlmsg_payload helper

[Breno Leitao]

Create a new helper function, nlmsg_payload(), to simplify checking and
retrieving Netlink message payloads.

This reduces boilerplate code for users who need to verify the message
length before accessing its data.

Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 include/net/netlink.h | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/include/net/netlink.h b/include/net/netlink.h
index 29e0db9403820..6343516f131cc 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -611,6 +611,19 @@ static inline int nlmsg_len(const struct nlmsghdr *nlh)
 	return nlh->nlmsg_len - NLMSG_HDRLEN;
 }
 
+/**
+ * nlmsg_payload - message payload if the data fits in the len
+ * @nlh: netlink message header
+ * @len: struct length
+ */
+static inline void *nlmsg_payload(const struct nlmsghdr *nlh, size_t len)
+{
+	if (nlh->nlmsg_len < nlmsg_msg_size(len))
+		return NULL;
+
+	return nlmsg_data(nlh);
+}
+
 /**
  * nlmsg_attrdata - head of attributes data
  * @nlh: netlink message header

-- 
2.47.1

[PATCH net-next 2/9] neighbour: Use nlmsg_payload in neightbl_valid_dump_info

[Breno Leitao]

Update neightbl_valid_dump_info function to utilize the new
nlmsg_payload() helper function.

This change improves code clarity and safety by ensuring that the
Netlink message payload is properly validated before accessing its data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/core/neighbour.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a07249b59ae1e..b6bc4836c6e45 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2430,12 +2430,12 @@ static int neightbl_valid_dump_info(const struct nlmsghdr *nlh,
 {
 	struct ndtmsg *ndtm;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndtm))) {
+	ndtm = nlmsg_payload(nlh, sizeof(*ndtm));
+	if (!ndtm) {
 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor table dump request");
 		return -EINVAL;
 	}
 
-	ndtm = nlmsg_data(nlh);
 	if (ndtm->ndtm_pad1  || ndtm->ndtm_pad2) {
 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor table dump request");
 		return -EINVAL;

-- 
2.47.1

[PATCH net-next 3/9] neighbour: Use nlmsg_payload in neigh_valid_get_req

[Breno Leitao]

Update neigh_valid_get_req function to utilize the new nlmsg_payload()
helper function.

This change improves code clarity and safety by ensuring that the
Netlink message payload is properly validated before accessing its data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/core/neighbour.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b6bc4836c6e45..65cf582b5dacd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2855,12 +2855,12 @@ static int neigh_valid_get_req(const struct nlmsghdr *nlh,
 	struct ndmsg *ndm;
 	int err, i;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
+	ndm = nlmsg_payload(nlh, sizeof(*ndm));
+	if (!ndm) {
 		NL_SET_ERR_MSG(extack, "Invalid header for neighbor get request");
 		return -EINVAL;
 	}
 
-	ndm = nlmsg_data(nlh);
 	if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
 	    ndm->ndm_type) {
 		NL_SET_ERR_MSG(extack, "Invalid values in header for neighbor get request");

-- 
2.47.1

[PATCH net-next 4/9] rtnetlink: Use nlmsg_payload in valid_fdb_dump_strict

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/core/rtnetlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 39a5b72e861f6..31addd26b5570 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4886,12 +4886,12 @@ static int valid_fdb_dump_strict(const struct nlmsghdr *nlh,
 	struct ndmsg *ndm;
 	int err, i;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ndm))) {
+	ndm = nlmsg_payload(nlh, sizeof(*ndm));
+	if (!ndm) {
 		NL_SET_ERR_MSG(extack, "Invalid header for fdb dump request");
 		return -EINVAL;
 	}
 
-	ndm = nlmsg_data(nlh);
 	if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
 	    ndm->ndm_flags || ndm->ndm_type) {
 		NL_SET_ERR_MSG(extack, "Invalid values in header for fdb dump request");

-- 
2.47.1

[PATCH net-next 5/9] mpls: Use nlmsg_payload in mpls_valid_fib_dump_req

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/mpls/af_mpls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 1f63b32d76d67..bf7cd290c2369 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2095,12 +2095,12 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
 	struct rtmsg *rtm;
 	int err, i;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*rtm))) {
+	rtm = nlmsg_payload(nlh, sizeof(*rtm));
+	if (!rtm) {
 		NL_SET_ERR_MSG_MOD(extack, "Invalid header for FIB dump request");
 		return -EINVAL;
 	}
 
-	rtm = nlmsg_data(nlh);
 	if (rtm->rtm_dst_len || rtm->rtm_src_len  || rtm->rtm_tos   ||
 	    rtm->rtm_table   || rtm->rtm_scope    || rtm->rtm_type  ||
 	    rtm->rtm_flags) {

-- 
2.47.1

[PATCH net-next 6/9] ipv6: Use nlmsg_payload in inet6_valid_dump_ifaddr_req

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/ipv6/addrconf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9ba83f0c99283..a9aeb949d9c8e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5346,12 +5346,12 @@ static int inet6_valid_dump_ifaddr_req(const struct nlmsghdr *nlh,
 	struct ifaddrmsg *ifm;
 	int err, i;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifm))) {
+	ifm = nlmsg_payload(nlh, sizeof(*ifm));
+	if (!ifm) {
 		NL_SET_ERR_MSG_MOD(extack, "Invalid header for address dump request");
 		return -EINVAL;
 	}
 
-	ifm = nlmsg_data(nlh);
 	if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) {
 		NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for address dump request");
 		return -EINVAL;

-- 
2.47.1

[PATCH net-next 7/9] ipv6: Use nlmsg_payload in inet6_rtm_valid_getaddr_req

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/ipv6/addrconf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a9aeb949d9c8e..4af2761795428 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5484,7 +5484,8 @@ static int inet6_rtm_valid_getaddr_req(struct sk_buff *skb,
 	struct ifaddrmsg *ifm;
 	int i, err;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifm))) {
+	ifm = nlmsg_payload(nlh, sizeof(*ifm));
+	if (!ifm) {
 		NL_SET_ERR_MSG_MOD(extack, "Invalid header for get address request");
 		return -EINVAL;
 	}
@@ -5493,7 +5494,6 @@ static int inet6_rtm_valid_getaddr_req(struct sk_buff *skb,
 		return nlmsg_parse_deprecated(nlh, sizeof(*ifm), tb, IFA_MAX,
 					      ifa_ipv6_policy, extack);
 
-	ifm = nlmsg_data(nlh);
 	if (ifm->ifa_prefixlen || ifm->ifa_flags || ifm->ifa_scope) {
 		NL_SET_ERR_MSG_MOD(extack, "Invalid values in header for get address request");
 		return -EINVAL;

-- 
2.47.1

[PATCH net-next 8/9] mpls: Use nlmsg_payload in mpls_valid_getroute_req

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/mpls/af_mpls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index bf7cd290c2369..d536c97144e9d 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2288,7 +2288,8 @@ static int mpls_valid_getroute_req(struct sk_buff *skb,
 	struct rtmsg *rtm;
 	int i, err;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*rtm))) {
+	rtm = nlmsg_payload(nlh, sizeof(*rtm));
+	if (!rtm) {
 		NL_SET_ERR_MSG_MOD(extack,
 				   "Invalid header for get route request");
 		return -EINVAL;
@@ -2298,7 +2299,6 @@ static int mpls_valid_getroute_req(struct sk_buff *skb,
 		return nlmsg_parse_deprecated(nlh, sizeof(*rtm), tb, RTA_MAX,
 					      rtm_mpls_policy, extack);
 
-	rtm = nlmsg_data(nlh);
 	if ((rtm->rtm_dst_len && rtm->rtm_dst_len != 20) ||
 	    rtm->rtm_src_len || rtm->rtm_tos || rtm->rtm_table ||
 	    rtm->rtm_protocol || rtm->rtm_scope || rtm->rtm_type) {

-- 
2.47.1

[PATCH net-next 9/9] net: fib_rules: Use nlmsg_payload in fib_valid_dumprule_req

[Breno Leitao]

Leverage the new nlmsg_payload() helper to avoid checking for message
size and then reading the nlmsg data.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/core/fib_rules.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 4bc64d912a1c0..6a7a28bf631c2 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -1238,12 +1238,12 @@ static int fib_valid_dumprule_req(const struct nlmsghdr *nlh,
 {
 	struct fib_rule_hdr *frh;
 
-	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*frh))) {
+	frh = nlmsg_payload(nlh, sizeof(*frh));
+	if (!frh) {
 		NL_SET_ERR_MSG(extack, "Invalid header for fib rule dump request");
 		return -EINVAL;
 	}
 
-	frh = nlmsg_data(nlh);
 	if (frh->dst_len || frh->src_len || frh->tos || frh->table ||
 	    frh->res1 || frh->res2 || frh->action || frh->flags) {
 		NL_SET_ERR_MSG(extack,

-- 
2.47.1

Re: [PATCH net-next 1/9] netlink: Introduce nlmsg_payload helper

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:48 -0700
> Create a new helper function, nlmsg_payload(), to simplify checking and
> retrieving Netlink message payloads.
> 
> This reduces boilerplate code for users who need to verify the message
> length before accessing its data.
> 
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 2/9] neighbour: Use nlmsg_payload in neightbl_valid_dump_info

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:49 -0700
> Update neightbl_valid_dump_info function to utilize the new
> nlmsg_payload() helper function.
> 
> This change improves code clarity and safety by ensuring that the
> Netlink message payload is properly validated before accessing its data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 3/9] neighbour: Use nlmsg_payload in neigh_valid_get_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:50 -0700
> Update neigh_valid_get_req function to utilize the new nlmsg_payload()
> helper function.
> 
> This change improves code clarity and safety by ensuring that the
> Netlink message payload is properly validated before accessing its data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 4/9] rtnetlink: Use nlmsg_payload in valid_fdb_dump_strict

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:51 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 5/9] mpls: Use nlmsg_payload in mpls_valid_fib_dump_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:52 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 6/9] ipv6: Use nlmsg_payload in inet6_valid_dump_ifaddr_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:53 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 7/9] ipv6: Use nlmsg_payload in inet6_rtm_valid_getaddr_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:54 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 8/9] mpls: Use nlmsg_payload in mpls_valid_getroute_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:55 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net-next 9/9] net: fib_rules: Use nlmsg_payload in fib_valid_dumprule_req

[Kuniyuki Iwashima]

From: Breno Leitao <leitao@debian.org>
Date: Fri, 11 Apr 2025 10:00:56 -0700
> Leverage the new nlmsg_payload() helper to avoid checking for message
> size and then reading the nlmsg data.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

You can use it for fib_newrule() and fib_delrule() where
nlmsg_data() is prefetched.

Re: [PATCH net-next 1/9] netlink: Introduce nlmsg_payload helper

[Jakub Kicinski]

On Fri, 11 Apr 2025 10:00:48 -0700 Breno Leitao wrote:
> +/**
> + * nlmsg_payload - message payload if the data fits in the len
> + * @nlh: netlink message header
> + * @len: struct length
> + */

W=1 now warns about the lack of Return: statements and we return 
the pointer here. We gotta add it to the kdoc.

With that fixed:

Reviewed-by: Jakub Kicinski <kuba@kernel.org>
-- 
pw-bot: cr

Re: [PATCH net-next 9/9] net: fib_rules: Use nlmsg_payload in fib_valid_dumprule_req

[Breno Leitao]

On Fri, Apr 11, 2025 at 02:38:01PM -0700, Kuniyuki Iwashima wrote:
> From: Breno Leitao <leitao@debian.org>
> Date: Fri, 11 Apr 2025 10:00:56 -0700
> > Leverage the new nlmsg_payload() helper to avoid checking for message
> > size and then reading the nlmsg data.
> > 
> > Signed-off-by: Breno Leitao <leitao@debian.org>
> 
> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
> 
> You can use it for fib_newrule() and fib_delrule() where
> nlmsg_data() is prefetched.

Agree. the code becomes way more readable, and more looks like more
"net" code.

Thanks for the suggestion, I am adding an additional patch for this one.

--breno