[PATCH net-next] netdev: check for nla_put_u32() failures

[PATCH net-next] netdev: check for nla_put_u32() failures

[Jakub Kicinski]

Make sure we check if nla_put_u32(id) was successful after creating
objects. This is theoretical today, the skbs are large enough to
always fit the ID.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
 - don't handle, just WARN
v1: https://lore.kernel.org/20260609190804.1137085-2-kuba@kernel.org

CC: daniel@iogearbox.net
CC: bobbyeshleman@gmail.com
CC: joe@dama.to
CC: razor@blackwall.org
CC: sdf@fomichev.me
CC: dw@davidwei.uk
---
 net/core/netdev-genl.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
index c0a86f3ae33b..fa9edfdb32c2 100644
--- a/net/core/netdev-genl.c
+++ b/net/core/netdev-genl.c
@@ -1119,7 +1119,9 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
 			goto err_unbind;
 	}
 
-	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
+	/* rsp was allocated large enough */
+	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id));
+
 	genlmsg_end(rsp, hdr);
 
 	err = genlmsg_reply(rsp, info);
@@ -1253,7 +1255,9 @@ int netdev_nl_bind_tx_doit(struct sk_buff *skb, struct genl_info *info)
 		goto err_unlock_bind_dev;
 	}
 
-	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
+	/* rsp was allocated large enough */
+	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id));
+
 	genlmsg_end(rsp, hdr);
 
 	if (bind_dev != netdev)
@@ -1420,7 +1424,9 @@ int netdev_nl_queue_create_doit(struct sk_buff *skb, struct genl_info *info)
 
 	netdev_rx_queue_lease(rxq, rxq_lease);
 
-	nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id);
+	/* rsp was allocated large enough */
+	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id));
+
 	genlmsg_end(rsp, hdr);
 
 	netdev_unlock(dev_lease);
-- 
2.55.0

Re: [PATCH net-next] netdev: check for nla_put_u32() failures

[Daniel Borkmann]

On 8/9/26 2:06 AM, Jakub Kicinski wrote:
> Make sure we check if nla_put_u32(id) was successful after creating
> objects. This is theoretical today, the skbs are large enough to
> always fit the ID.
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Re: [PATCH net-next] netdev: check for nla_put_u32() failures

[Nikolay Aleksandrov]

On 09/08/2026 03:06, Jakub Kicinski wrote:
> Make sure we check if nla_put_u32(id) was successful after creating
> objects. This is theoretical today, the skbs are large enough to
> always fit the ID.
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> v2:
>   - don't handle, just WARN
> v1: https://lore.kernel.org/20260609190804.1137085-2-kuba@kernel.org
> 
> CC: daniel@iogearbox.net
> CC: bobbyeshleman@gmail.com
> CC: joe@dama.to
> CC: razor@blackwall.org
> CC: sdf@fomichev.me
> CC: dw@davidwei.uk
> ---
>   net/core/netdev-genl.c | 12 +++++++++---
>   1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index c0a86f3ae33b..fa9edfdb32c2 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c
> @@ -1119,7 +1119,9 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>   			goto err_unbind;
>   	}
>   
> -	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	/* rsp was allocated large enough */
> +	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id));
> +
>   	genlmsg_end(rsp, hdr);
>   
>   	err = genlmsg_reply(rsp, info);
> @@ -1253,7 +1255,9 @@ int netdev_nl_bind_tx_doit(struct sk_buff *skb, struct genl_info *info)
>   		goto err_unlock_bind_dev;
>   	}
>   
> -	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	/* rsp was allocated large enough */
> +	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id));
> +
>   	genlmsg_end(rsp, hdr);
>   
>   	if (bind_dev != netdev)
> @@ -1420,7 +1424,9 @@ int netdev_nl_queue_create_doit(struct sk_buff *skb, struct genl_info *info)
>   
>   	netdev_rx_queue_lease(rxq, rxq_lease);
>   
> -	nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id);
> +	/* rsp was allocated large enough */
> +	WARN_ON_ONCE(nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id));
> +
>   	genlmsg_end(rsp, hdr);
>   
>   	netdev_unlock(dev_lease);

Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>