[PATCH iproute2 v2 1/2] ip route: use the request size as the limit when adding encap

[Fang Jiabao <kaquoin@163.com>]

iproute_modify() passes a hardcoded 1024 as the size limit to
addraw_l() when it adds the encap attribute. The request buffer is
larger than that, and every other attribute in this function is bounded
by sizeof(req). With a seg6 encap of 60 segments the request still fits
in the buffer, but addraw_l() prints "addraw_l ERROR: message exceeded
bound of 1024" and returns -1. The return value is ignored, so ip sends
the request without the encap attribute and exits with status 0, and a
route without encap is installed silently.

Use sizeof(req) as the limit, like the other attributes, and return an
error if addraw_l() fails instead of sending an incomplete request.

Fixes: 1e5293056a02 ("lwtunnel: Add encapsulation support to ip route")
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Fang Jiabao <kaquoin@163.com>
---
Changes since v1:
  - use sizeof(req) as the limit instead of 1024, as suggested by
    Stephen Hemminger; keep the check of the return value
  - rewrite the commit message to describe the cause
  - add the same fix for ip nexthop as patch 2/2
v1: https://lore.kernel.org/netdev/20261102090535.226168-1-kaquoin@163.com/

Tested on current main (d95f6650, "man: ip-neighbour.8: document
protocol keyword"), in a network namespace with a dummy device, with:

  ip -6 route add fc00:ff::N/128 encap seg6 mode encap segs <N SIDs> dev d0

With 59, 60 and 62 segments the route is added with encap, exit status
0. Before, 60 segments printed an addraw_l() error and installed a route
without encap, exit status 0 (observed on e4cd9f1d, the only commit
since then changes a man page). With 63 segments the result is
unchanged: error from lwt_parse_encap(), exit status 255, no route
installed. I did not find a way to make addraw_l() fail from the command
line after this change, so that error path is not tested.

 ip/iproute.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/ip/iproute.c b/ip/iproute.c
index 1ce71f78..067569c2 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -1525,9 +1525,10 @@ static int iproute_modify(int cmd, unsigned int flags, int argc, char **argv)
 			lwt_parse_encap(rta, sizeof(buf), &argc, &argv,
 					RTA_ENCAP, RTA_ENCAP_TYPE);
 
-			if (rta->rta_len > RTA_LENGTH(0))
-				addraw_l(&req.n, 1024
-					 , RTA_DATA(rta), RTA_PAYLOAD(rta));
+			if (rta->rta_len > RTA_LENGTH(0) &&
+			    addraw_l(&req.n, sizeof(req), RTA_DATA(rta),
+				     RTA_PAYLOAD(rta)) < 0)
+				return -1;
 		} else if (strcmp(*argv, "ttl-propagate") == 0) {
 			__u8 ttl_prop;
 
-- 
2.43.0