Re: [PATCH] net: page_pool: check nla_nest_start() return value in page_pool_nl_stats_fill()

[Jakub Kicinski <kuba@kernel.org>]

On Tue, 26 May 2026 18:04:44 +0200 Alexander Lobakin wrote:
> From: Zhao Dongdong <winter91@foxmail.com>
> Date: Tue, 26 May 2026 14:51:56 +0800
> 
> > From: Zhao Dongdong <zhaodongdong@kylinos.cn>
> > 
> > nla_nest_start() can return NULL if the skb runs out of space.
> > page_pool_nl_stats_fill() does not check the return value before
> > calling nla_nest_end(), which can lead to a NULL pointer dereference.
> > Add a NULL check after nla_nest_start() and abort the message if it fails.
> > 
> > Fixes: d49010adae73 ("net: page_pool: expose page pool stats via netlink")  
> 
> A "Cc: stable@vger.kernel.org" candidate?

Not really, the thinking is that if nla_nest_start() failed then the
very next nla_put* will also fail (nla_nest_start() is a zero-length
attr, any attr we put after must be >= in length).

IOW the commit message is lying, there's no way for us to reach
nla_nest_end(). We will jump to nla_nest_cancel() which handles
nest=NULL just fine.

Zhao Dongdong please confirm this and respin the patch without a Fixes 
tag and with an updated commit message. I think we got such a patch
in the past, so we should merge it to avoid confusing bots. 
But please make it very clear that this code can't crash..
-- 
pw-bot: cr