Re: net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Sep 14, 2026 at 10:21:08AM -0700, Jakub Kicinski wrote:
> On Mon, 14 Sep 2026 15:21:59 +0100 Quentin Armitage wrote:
> > Commit fa8fca88714c - "ipv4: validate IPV4_DEVCONF attributes properly" changed
> > inet_validate_link_af() to call nla_parse_nested() rather than
> > nla_for_each_nested() for IFLA_INET_CONF. A side effect of this change is that
> > the code now checks that NLA_F_NESTED is set for IFLA_INET_CONF, and rejects the
> > message if it is not, whereas previously there was no check for NLA_F_NESTED
> > being set.
> > 
> > The consequence of this is that code which worked prior to Linux 7.1, albeit
> > erroneously not setting NLA_F_NESTED now fails.
> > 
> > In order to maintain backward compatibility, rather than calling
> > nla_parse_nested(), nla_parse_nested_deprecated() should be called, as it is
> > earlier in the function.
> 
> Please explain how you discovered the problem.
> Is there some open source or closed source SW you're aware of which
> breaks?

FWIW, I sent a patch to keepalived in the past and I remember Quentin
from there. It seems to be affected:

https://github.com/acassen/keepalived/blob/6d6194307e11a3d55870633fe00a50b56db7e3b8/keepalived/vrrp/vrrp_if_config.c#L172
https://github.com/acassen/keepalived/blob/6d6194307e11a3d55870633fe00a50b56db7e3b8/keepalived/vrrp/vrrp_if_config.c#L210