[PATCH nf-next] netfilter: nfnetlink_log: collapse both dev log blocks

[PATCH nf-next] netfilter: nfnetlink_log: collapse both dev log blocks

[Florian Westphal]

Looked like this:

 if (indev && skb->dev &&
   skb_mac_header_was_set(skb) &&
   skb_mac_header_len(skb) != 0) {
...
 }

 if (indev && skb_mac_header_was_set(skb)) {
...
 }

LLM (sashiko) claims there is a NULL deref in the second block, because
it dereferences skb->dev without checking skb->dev != NULL.

Don't know if `indev && !skb->dev` is even possible:
NF_HOOK() invocation normally passes skb->dev as the indev argument.

Instead of cargo-culting additional skb->dev check, lets just merge
both blocks into one. This gives 2nd block the tighter guards and
results in a small behavioral change:

When `skb_mac_header_was_set` is true but `skb_mac_header_len == 0`
HWADDR was not emitted, but HWTYPE/HWLEN was.  But given 2nd block also
emits NFULA_HWHEADER based off skb->dev->hard_header_len, that change
is probably desireable.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nfnetlink_log.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index dddbaf6860cc..3df2998b8cc0 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -600,9 +600,7 @@ __build_packet_message(struct nfnl_log_net *log,
 			if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
 				goto nla_put_failure;
 		}
-	}
 
-	if (indev && skb_mac_header_was_set(skb)) {
 		if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
 		    nla_put_be16(inst->skb, NFULA_HWLEN,
 				 htons(skb->dev->hard_header_len)))
-- 
2.55.0

Re: [PATCH nf-next] netfilter: nfnetlink_log: collapse both dev log blocks

[Florian Westphal]

Florian Westphal <fw@strlen.de> wrote:
> Looked like this:
> 
>  if (indev && skb->dev &&
>    skb_mac_header_was_set(skb) &&
>    skb_mac_header_len(skb) != 0) {
> ...
>  }
> 
>  if (indev && skb_mac_header_was_set(skb)) {
> ...
>  }
> 
> LLM (sashiko) claims there is a NULL deref in the second block, because
> it dereferences skb->dev without checking skb->dev != NULL.
> 
> Don't know if `indev && !skb->dev` is even possible:
> NF_HOOK() invocation normally passes skb->dev as the indev argument.
> 
> Instead of cargo-culting additional skb->dev check, lets just merge
> both blocks into one. This gives 2nd block the tighter guards and
> results in a small behavioral change:
> 
> When `skb_mac_header_was_set` is true but `skb_mac_header_len == 0`
> HWADDR was not emitted, but HWTYPE/HWLEN was.  But given 2nd block also
> emits NFULA_HWHEADER based off skb->dev->hard_header_len, that change
> is probably desireable.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>

AI review doesn't like this, but I'm not so sure about the comment.

https://sashiko.dev/#/patchset/20261002124132.13387-1-fw%40strlen.de

NFULA_HWADDR (and related) are not univerally available even today,
their presence depends on hook/location that invoked nfnl logger.

NFULA_HWHEADER would even contain the l3 header in the LLM-presented
case. So I think this patch is fine as-is.