Re: [net-next,v5,03/16] net: Add lease info to queue-get response

[Jakub Kicinski <kuba@kernel.org>]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least pausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
    net: Add lease info to queue-get response

This commit populates nested lease info in the queue-get response, returning
the ifindex, queue id with type, and optionally the netns id if the device
resides in a different network namespace.

> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index cd4dc4eef029..002d68f62131 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c

[ ... ]

> @@ -410,6 +413,37 @@ netdev_nl_queue_fill_one(struct sk_buff *rsp, struct net_device *netdev,
>  		if (nla_put_napi_id(rsp, rxq->napi))
>  			goto nla_put_failure;
>
> +		if (netif_rx_queue_lease_get_owner(&netdev, &lease_q_idx)) {
> +			struct net *net, *peer_net;
> +
> +			nest_lease = nla_nest_start(rsp, NETDEV_A_QUEUE_LEASE);
> +			if (!nest_lease)
> +				goto nla_put_failure;
> +			nest_queue = nla_nest_start(rsp, NETDEV_A_LEASE_QUEUE);
> +			if (!nest_lease)
                            ^^^^^^^^^^

Should this check nest_queue instead of nest_lease? The assignment is to
nest_queue but the check is on nest_lease. If nla_nest_start() fails for
NETDEV_A_LEASE_QUEUE and returns NULL, the check passes because nest_lease
is non-NULL from the previous successful call. This would lead to
nla_nest_end(rsp, nest_queue) being called with a NULL pointer, causing a
NULL pointer dereference when accessing start->nla_len.

> +				goto nla_put_failure;

[ ... ]
-- 
pw-bot: cr