[PATCH net-next 1/2] netlink: specs: tcp_metrics: fix the attribute length checks

[PATCH net-next 1/2] netlink: specs: tcp_metrics: fix the attribute length checks

[Jakub Kicinski]

TCP_FASTOPEN_COOKIE_MAX is the longest cookie we accept, not the shortest
one. Cookies are even sized, from 4 bytes up, and the ones Linux itself
generates are 8 bytes, so a 16 byte minimum declares all but the longest
cookie invalid. The reference policy kept under #if 0 in tcp_metrics.c
spells it as a maximum, which is what .len means for NLA_BINARY.

The IPv6 addresses err the other way. The policy uses
NLA_POLICY_EXACT_LEN() for both, so a request carrying a longer address is
rejected with -ERANGE, even though the spec advertises 16 bytes as a mere
minimum. Were the policy generated from this spec, as kernel-policy: global
promises, the check would turn into NLA_POLICY_MIN_LEN() and start
accepting over-long addresses, of which nla_get_in6_addr() would take the
first 16 bytes.

Nothing generated changes. fopen-cookie is reply-only so it never gets a
policy entry, and exact-len only feeds the policy (and the fixed size array
form, which needs a sub-type).

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/tcp_metrics.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/netlink/specs/tcp_metrics.yaml b/Documentation/netlink/specs/tcp_metrics.yaml
index 13144aeed31a..1d365908084d 100644
--- a/Documentation/netlink/specs/tcp_metrics.yaml
+++ b/Documentation/netlink/specs/tcp_metrics.yaml
@@ -32,7 +32,7 @@ kernel-policy: global
         name: addr-ipv6
         type: binary
         checks:
-          min-len: 16
+          exact-len: 16
         byte-order: big-endian
         display-hint: ipv6
       -
@@ -63,7 +63,7 @@ kernel-policy: global
         name: fopen-cookie
         type: binary
         checks:
-          min-len: tcp-fastopen-cookie-max
+          max-len: tcp-fastopen-cookie-max
       -
         name: saddr-ipv4
         type: u32
@@ -73,7 +73,7 @@ kernel-policy: global
         name: saddr-ipv6
         type: binary
         checks:
-          min-len: 16
+          exact-len: 16
         byte-order: big-endian
         display-hint: ipv6
       -
-- 
2.55.0

[PATCH net-next 2/2] netlink: specs: tcp_metrics: drop the RTT shift instructions

[Jakub Kicinski]

All four RTT attributes tell the reader to left-shift, which inflates the
value by 16 to 64 times, and the two usec ones say the result is in msecs.
The attributes carry srtt_us and mdev_us, which hold 3 and 2 fractional
bits. The shift to get the integer part would be a right shift.

Drop the instructions instead of turning them around. The number of
fractional bits is the part worth documenting, whether to shift, divide or
convert to a double is up to the caller.

While at it fix the acronym on the two variance attributes.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/tcp_metrics.yaml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/Documentation/netlink/specs/tcp_metrics.yaml b/Documentation/netlink/specs/tcp_metrics.yaml
index 1d365908084d..779e8a22b765 100644
--- a/Documentation/netlink/specs/tcp_metrics.yaml
+++ b/Documentation/netlink/specs/tcp_metrics.yaml
@@ -93,14 +93,12 @@ kernel-policy: global
         name: rtt
         type: u32
         doc: |
-          Round Trip Time (RTT), in msecs with 3 bits fractional
-          (left-shift by 3 to get the msec value).
+          Round Trip Time (RTT), in msecs with 3 bits fractional.
       -
         name: rttvar
         type: u32
         doc: |
-          Round Trip Time VARiance (RTT), in msecs with 2 bits fractional
-          (left-shift by 2 to get the msec value).
+          Round Trip Time VARiance (RTTVAR), in msecs with 2 bits fractional.
       -
         name: ssthresh
         type: u32
@@ -117,14 +115,12 @@ kernel-policy: global
         name: rtt-us
         type: u32
         doc: |
-          Round Trip Time (RTT), in usecs, with 3 bits fractional
-          (left-shift by 3 to get the msec value).
+          Round Trip Time (RTT), in usecs, with 3 bits fractional.
       -
         name: rttvar-us
         type: u32
         doc: |
-          Round Trip Time (RTT), in usecs, with 2 bits fractional
-          (left-shift by 3 to get the msec value).
+          Round Trip Time VARiance (RTTVAR), in usecs, with 2 bits fractional.
 
 operations:
   list:
-- 
2.55.0

Re: [PATCH net-next 1/2] netlink: specs: tcp_metrics: fix the attribute length checks

[Hangbin Liu]

On Sat, Sep 12, 2026 at 04:43:36PM -0700, Jakub Kicinski wrote:
> TCP_FASTOPEN_COOKIE_MAX is the longest cookie we accept, not the shortest
> one. Cookies are even sized, from 4 bytes up, and the ones Linux itself
> generates are 8 bytes, so a 16 byte minimum declares all but the longest
> cookie invalid. The reference policy kept under #if 0 in tcp_metrics.c
> spells it as a maximum, which is what .len means for NLA_BINARY.
> 
> The IPv6 addresses err the other way. The policy uses
> NLA_POLICY_EXACT_LEN() for both, so a request carrying a longer address is
> rejected with -ERANGE, even though the spec advertises 16 bytes as a mere
> minimum. Were the policy generated from this spec, as kernel-policy: global
> promises, the check would turn into NLA_POLICY_MIN_LEN() and start
> accepting over-long addresses, of which nla_get_in6_addr() would take the
> first 16 bytes.
> 
> Nothing generated changes. fopen-cookie is reply-only so it never gets a
> policy entry, and exact-len only feeds the policy (and the fixed size array
> form, which needs a sub-type).
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
>  Documentation/netlink/specs/tcp_metrics.yaml | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/Documentation/netlink/specs/tcp_metrics.yaml b/Documentation/netlink/specs/tcp_metrics.yaml
> index 13144aeed31a..1d365908084d 100644
> --- a/Documentation/netlink/specs/tcp_metrics.yaml
> +++ b/Documentation/netlink/specs/tcp_metrics.yaml
> @@ -32,7 +32,7 @@ kernel-policy: global
>          name: addr-ipv6
>          type: binary
>          checks:
> -          min-len: 16
> +          exact-len: 16
>          byte-order: big-endian
>          display-hint: ipv6
>        -
> @@ -63,7 +63,7 @@ kernel-policy: global
>          name: fopen-cookie
>          type: binary
>          checks:
> -          min-len: tcp-fastopen-cookie-max
> +          max-len: tcp-fastopen-cookie-max
>        -
>          name: saddr-ipv4
>          type: u32
> @@ -73,7 +73,7 @@ kernel-policy: global
>          name: saddr-ipv6
>          type: binary
>          checks:
> -          min-len: 16
> +          exact-len: 16
>          byte-order: big-endian
>          display-hint: ipv6
>        -
> -- 
> 2.55.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net-next 2/2] netlink: specs: tcp_metrics: drop the RTT shift instructions

[Hangbin Liu]

On Sat, Sep 12, 2026 at 04:43:37PM -0700, Jakub Kicinski wrote:
> All four RTT attributes tell the reader to left-shift, which inflates the
> value by 16 to 64 times, and the two usec ones say the result is in msecs.
> The attributes carry srtt_us and mdev_us, which hold 3 and 2 fractional
> bits. The shift to get the integer part would be a right shift.
> 
> Drop the instructions instead of turning them around. The number of
> fractional bits is the part worth documenting, whether to shift, divide or
> convert to a double is up to the caller.
> 
> While at it fix the acronym on the two variance attributes.
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
>  Documentation/netlink/specs/tcp_metrics.yaml | 12 ++++--------
>  1 file changed, 4 insertions(+), 8 deletions(-)
> 
> diff --git a/Documentation/netlink/specs/tcp_metrics.yaml b/Documentation/netlink/specs/tcp_metrics.yaml
> index 1d365908084d..779e8a22b765 100644
> --- a/Documentation/netlink/specs/tcp_metrics.yaml
> +++ b/Documentation/netlink/specs/tcp_metrics.yaml
> @@ -93,14 +93,12 @@ kernel-policy: global
>          name: rtt
>          type: u32
>          doc: |
> -          Round Trip Time (RTT), in msecs with 3 bits fractional
> -          (left-shift by 3 to get the msec value).
> +          Round Trip Time (RTT), in msecs with 3 bits fractional.
>        -
>          name: rttvar
>          type: u32
>          doc: |
> -          Round Trip Time VARiance (RTT), in msecs with 2 bits fractional
> -          (left-shift by 2 to get the msec value).
> +          Round Trip Time VARiance (RTTVAR), in msecs with 2 bits fractional.
>        -
>          name: ssthresh
>          type: u32
> @@ -117,14 +115,12 @@ kernel-policy: global
>          name: rtt-us
>          type: u32
>          doc: |
> -          Round Trip Time (RTT), in usecs, with 3 bits fractional
> -          (left-shift by 3 to get the msec value).
> +          Round Trip Time (RTT), in usecs, with 3 bits fractional.
>        -
>          name: rttvar-us
>          type: u32
>          doc: |
> -          Round Trip Time (RTT), in usecs, with 2 bits fractional
> -          (left-shift by 3 to get the msec value).
> +          Round Trip Time VARiance (RTTVAR), in usecs, with 2 bits fractional.
>  
>  operations:
>    list:
> -- 
> 2.55.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net-next 1/2] netlink: specs: tcp_metrics: fix the attribute length checks

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Sat, 12 Sep 2026 16:43:36 -0700 you wrote:
> TCP_FASTOPEN_COOKIE_MAX is the longest cookie we accept, not the shortest
> one. Cookies are even sized, from 4 bytes up, and the ones Linux itself
> generates are 8 bytes, so a 16 byte minimum declares all but the longest
> cookie invalid. The reference policy kept under #if 0 in tcp_metrics.c
> spells it as a maximum, which is what .len means for NLA_BINARY.
> 
> The IPv6 addresses err the other way. The policy uses
> NLA_POLICY_EXACT_LEN() for both, so a request carrying a longer address is
> rejected with -ERANGE, even though the spec advertises 16 bytes as a mere
> minimum. Were the policy generated from this spec, as kernel-policy: global
> promises, the check would turn into NLA_POLICY_MIN_LEN() and start
> accepting over-long addresses, of which nla_get_in6_addr() would take the
> first 16 bytes.
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] netlink: specs: tcp_metrics: fix the attribute length checks
    https://git.kernel.org/netdev/net-next/c/4358a3e8e7cc
  - [net-next,2/2] netlink: specs: tcp_metrics: drop the RTT shift instructions
    https://git.kernel.org/netdev/net-next/c/1a523f29fe4f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html