* [PATCH net-next] netlink: add one debug check in nla_nest_end()
@ 2026-05-12 15:52 Eric Dumazet
0 siblings, 0 replies; only message in thread
From: Eric Dumazet @ 2026-05-12 15:52 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, netdev, eric.dumazet, Eric Dumazet
Add a DEBUG_NET_WARN_ON_ONCE(diff > U16_MAX)
to warn if the kernel sends corrupted nested attribute
to user space.
Offenders can be converted to nla_nest_end_safe().
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
include/net/netlink.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 546d10586576e7b1c44348ac48762667ebb00f61..b5048dd1d5115dc94e9ea18b3b6d1822c878a75d 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -2260,7 +2260,10 @@ static inline struct nlattr *nla_nest_start(struct sk_buff *skb, int attrtype)
*/
static inline int nla_nest_end(struct sk_buff *skb, struct nlattr *start)
{
- start->nla_len = skb_tail_pointer(skb) - (unsigned char *)start;
+ unsigned long diff = skb_tail_pointer(skb) - (unsigned char *)start;
+
+ DEBUG_NET_WARN_ON_ONCE(diff > U16_MAX);
+ start->nla_len = diff;
return skb->len;
}
--
2.54.0.563.g4f69b47b94-goog
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-05-12 15:52 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-12 15:52 [PATCH net-next] netlink: add one debug check in nla_nest_end() Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox