Re: [PATCH net-next 1/4] netdev: check for nla_put_u32() failures

[Bobby Eshleman <bobbyeshleman@gmail.com>]

On Tue, Jun 09, 2026 at 12:08:01PM -0700, Jakub Kicinski wrote:
> Make sure we check if nla_put_u32(id) was successful after creating
> objects. This is theoretical today, the skbs are large enough to
> always fit the ID.
> 
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
>  net/core/netdev-genl.c | 21 ++++++++++++++++++---
>  1 file changed, 18 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
> index b4d48f3672a5..a10d353d5eab 100644
> --- a/net/core/netdev-genl.c
> +++ b/net/core/netdev-genl.c
> @@ -1091,7 +1091,10 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
>  			goto err_unbind;
>  	}
>  
> -	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	err = nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	if (err)
> +		goto err_unbind;
> +
>  	genlmsg_end(rsp, hdr);
>  
>  	err = genlmsg_reply(rsp, info);
> @@ -1227,7 +1230,10 @@ int netdev_nl_bind_tx_doit(struct sk_buff *skb, struct genl_info *info)
>  		goto err_unlock_bind_dev;
>  	}
>  
> -	nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	err = nla_put_u32(rsp, NETDEV_A_DMABUF_ID, binding->id);
> +	if (err)
> +		goto err_unbind;
> +
>  	genlmsg_end(rsp, hdr);
>  
>  	if (bind_dev != netdev)
> @@ -1237,6 +1243,8 @@ int netdev_nl_bind_tx_doit(struct sk_buff *skb, struct genl_info *info)
>  
>  	return genlmsg_reply(rsp, info);
>  
> +err_unbind:
> +	net_devmem_unbind_dmabuf(binding);
>  err_unlock_bind_dev:
>  	if (bind_dev != netdev)
>  		netdev_unlock(bind_dev);
> @@ -1394,7 +1402,12 @@ int netdev_nl_queue_create_doit(struct sk_buff *skb, struct genl_info *info)
>  
>  	netdev_rx_queue_lease(rxq, rxq_lease);
>  
> -	nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id);
> +	err = nla_put_u32(rsp, NETDEV_A_QUEUE_ID, queue_id);
> +	if (err) {
> +		WARN_ON_ONCE(1); /* we can't delete the queue, ID must fit in */
> +		goto err_unlease;
> +	}
> +
>  	genlmsg_end(rsp, hdr);
>  
>  	netdev_unlock(dev_lease);
> @@ -1404,6 +1417,8 @@ int netdev_nl_queue_create_doit(struct sk_buff *skb, struct genl_info *info)
>  
>  	return genlmsg_reply(rsp, info);
>  
> +err_unlease:
> +	netdev_rx_queue_unlease(rxq, rxq_lease);
>  err_unlock_dev_lease:
>  	netdev_unlock(dev_lease);
>  err_put_netns:
> -- 
> 2.54.0
> 
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>