Re: [PATCH nf-next] netfilter: nfnetlink_log: collapse both dev log blocks

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> Looked like this:
> 
>  if (indev && skb->dev &&
>    skb_mac_header_was_set(skb) &&
>    skb_mac_header_len(skb) != 0) {
> ...
>  }
> 
>  if (indev && skb_mac_header_was_set(skb)) {
> ...
>  }
> 
> LLM (sashiko) claims there is a NULL deref in the second block, because
> it dereferences skb->dev without checking skb->dev != NULL.
> 
> Don't know if `indev && !skb->dev` is even possible:
> NF_HOOK() invocation normally passes skb->dev as the indev argument.
> 
> Instead of cargo-culting additional skb->dev check, lets just merge
> both blocks into one. This gives 2nd block the tighter guards and
> results in a small behavioral change:
> 
> When `skb_mac_header_was_set` is true but `skb_mac_header_len == 0`
> HWADDR was not emitted, but HWTYPE/HWLEN was.  But given 2nd block also
> emits NFULA_HWHEADER based off skb->dev->hard_header_len, that change
> is probably desireable.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>

AI review doesn't like this, but I'm not so sure about the comment.

https://sashiko.dev/#/patchset/20261002124132.13387-1-fw%40strlen.de

NFULA_HWADDR (and related) are not univerally available even today,
their presence depends on hook/location that invoked nfnl logger.

NFULA_HWHEADER would even contain the l3 header in the LLM-presented
case. So I think this patch is fine as-is.