Re: net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Sep 14, 2026 at 03:21:59PM +0100, Quentin Armitage wrote:
> Commit fa8fca88714c - "ipv4: validate IPV4_DEVCONF attributes properly" changed
> inet_validate_link_af() to call nla_parse_nested() rather than
> nla_for_each_nested() for IFLA_INET_CONF. A side effect of this change is that
> the code now checks that NLA_F_NESTED is set for IFLA_INET_CONF, and rejects the
> message if it is not, whereas previously there was no check for NLA_F_NESTED
> being set.
> 
> The consequence of this is that code which worked prior to Linux 7.1, albeit
> erroneously not setting NLA_F_NESTED now fails.
> 
> In order to maintain backward compatibility, rather than calling
> nla_parse_nested(), nla_parse_nested_deprecated() should be called, as it is
> earlier in the function.

I don't think nla_parse_nested_deprecated() is safe. It will allow
attributes exceeding the maximum type or with type 0, which can then
crash in inet_set_link_af(). Can you try nla_parse_deprecated_strict()
instead?

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a90be57c63be..4e0e153f504f 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2117,10 +2117,10 @@ static int inet_validate_link_af(const struct net_device *dev,
 		return err;
 
 	if (tb[IFLA_INET_CONF]) {
-		err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX,
-				       tb[IFLA_INET_CONF], inet_devconf_policy,
-				       extack);
-
+		err = nla_parse_deprecated_strict(nested_tb, IPV4_DEVCONF_MAX,
+						  nla_data(tb[IFLA_INET_CONF]),
+						  nla_len(tb[IFLA_INET_CONF]),
+						  inet_devconf_policy, extack);
 		if (err < 0)
 			return err;
 	}

> 
> FWIW the following patch makes the change.
> 
> commit 5f372809f2f07fe7ed5b91b4293945e8a7fd343b
> Author: Quentin Armitage <quentin@armitage.org.uk>
> Date:   Mon Sep 14 15:10:42 2026 +0100
> 
>     net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
>     
>     Commit fa8fca88714c - "ipv4: validate IPV4_DEVCONF attributes properly"

Proper way to cite a commit (I believe checkpatch flags it):

Commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")

>     added validation of IFLA_INET_CONF attributes, and in the process
>     changed the call of nla_for_each_nested() to nla_parse_nested(). A
>     side effect of this change is that the IFLA_INET_CONF option is now
>     tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
>     commit there was no check of NLA_F_NESTED.
>     
>     Changing nla_parse_nested() to nla_parse_nested_decrecated() restores

Use imperative mood: Change nla_parse_nested() ...

>     the previous functionality of not checking for NLA_F_NESTED, thereby
>     allowing code that (incorrectly) doesn't set NLA_F_NESTED to continue to
>     work.
>     

Missing a Fixes tag:

Fixes: fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly")

Please read:

https://docs.kernel.org/next/process/maintainer-netdev.html

Before submitting formally.

>     Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>

Thanks