Re: [PATCH iproute2] ip/iplink: fix off-by-one KIND length in modify()

[Stephen Hemminger <stephen@networkplumber.org>]

On Tue, 13 Jan 2026 12:41:27 +0100
Jan Vaclav <jvaclav@redhat.com> wrote:

> The expected size for IFLA_INFO_KIND in kernel is strlen(kind) + 1.
> See `size` in rtnl_link_get_size() in net/core/rtnetlink.c.
> 
> Fixes: 1d93483985f0 ("iplink: use netlink for link configuration")
> Reported-by: Gris Ge <fge@redhat.com>
> Signed-off-by: Jan Vaclav <jvaclav@redhat.com>
> ---

Good catch.
It does raise the issue why IFLA_ALIAS is a binary attribute.

FYI - AI code review agrees.

I'll review this patch by examining all three files you've provided.Now let me provide my review based on the analysis.

---

## Patch Review: `[PATCH iproute2] ip/iplink: fix off-by-one KIND length in modify()`

**Verdict: Patch is correct and should be applied.**

### Analysis

The patch changes:
```c
addattr_l(&req.n, sizeof(req), IFLA_INFO_KIND, type,
-         strlen(type));
+         strlen(type) + 1);
```

This is the right fix. Here's why:

**1. Kernel Policy Requires NLA_STRING**

In `rtnetlink.c:2264`:
```c
[IFLA_INFO_KIND]	= { .type = NLA_STRING },
```

The `NLA_STRING` type expects a null-terminated string. The netlink validation layer checks that the last byte is `'\0'`.

**2. Kernel Size Calculation Includes Null Terminator**

In `rtnetlink.c:730` (`rtnl_link_get_size()`):
```c
nla_total_size(strlen(ops->kind) + 1);  /* IFLA_INFO_KIND */
```

The kernel explicitly accounts for `strlen + 1` when calculating buffer sizes for outbound messages.

**3. Kernel Uses `nla_put_string()` for Outbound**

In `rtnetlink.c:889`:
```c
nla_put_string(skb, IFLA_INFO_KIND, ops->kind)
```

`nla_put_string()` includes the null terminator, so kernel-to-userspace messages include it.

**4. Why It Worked Before (Probably)**

The current code likely "works" by accident due to netlink's 4-byte alignment requirements. When `addattr_l()` adds an attribute, padding bytes are typically zeroed. For most type strings, the padding happens to provide the null terminator. But this is unreliable:
- If `strlen(type) % 4 == 0`, no padding is added
- Different `addattr_l` implementations may not zero padding

**5. Contrast with IFLA_IFALIAS**

Interestingly, `IFLA_IFALIAS` at line 796-797 also uses `strlen()` without `+1`, but that's actually correct because the kernel explicitly treats it as `NLA_BINARY` (see `rtnetlink.c:2218-2221`) and uses `nla_len()` directly rather than relying on null termination.

### Minor Comment

The commit message is good - it correctly references the kernel source and includes proper tags. One small enhancement might be to note that this has worked by luck due to alignment padding, but that's optional.

**Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>**