[PATCH] rust: net: netlink: validate attribute length before casting to `c_int`
From: Sagar Taunk <hidden>
Date: 2026-09-13 02:17:55
Also in:
lkml, rust-for-linux
Subsystem:
networking [general], rust, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Miguel Ojeda, Linus Torvalds
As pointed out by Sashiko, `put()` trusted an unchecked `as` cast from `usize` to `c_int`. When the length exceeds `i32::MAX`, that cast wraps around to a negative value. `nla_put()`'s `skb_tailroom()` check treats the length as signed, so the wrapped negative value slips past it. Further down, `__nla_reserve()` and `skb_put` reinterpret the same value as unsigned, turning it into an enormous length and triggering a kernel panic via `skb_over_panic()`. So, validate the cast with `c_int::try_from()` instead, and return `EMSGSIZE` when the length doesn't fit. Signed-off-by: Sagar Taunk <redacted> --- rust/kernel/net/netlink.rs | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs
index 3c2b142a7402..f929f63b32c1 100644
--- a/rust/kernel/net/netlink.rs
+++ b/rust/kernel/net/netlink.rs@@ -88,11 +88,19 @@ fn put<T>(&mut self, attrtype: c_int, value: &T) -> Result T: ?Sized + IntoBytes + Immutable, { let skb = self.skb.skb.as_ptr(); - let len = size_of_val(value); - let ptr = core::ptr::from_ref(value).cast::<c_void>(); - // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and the provided value is - // readable and initialized for its `size_of` bytes. - to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, ptr) }) + let bytes = value.as_bytes(); + // `nla_put()` takes attrlen as a plain `c_int`. If `bytes.len()` + // doesn't fit, an `as` cast would wrap around a negative value. + // Which then, would feed a huge unsigned length to `__nla_reserve()` + // and `skb_put()` causing it to panic via `skb_over_panic()`. So, + // the following check will reject it instead. + let len = c_int::try_from(bytes.len()).map_err(|_| EMSGSIZE)?; + let ptr = bytes.as_ptr().cast::<c_void>(); + // SAFETY: `skb` is valid as per `NetlinkSkBuff` type invariants. + // `bytes` is a valid Rust slice, so `ptr` is readable for `len` + // bytes, and `T: Immutable` guarantees nothing can mutate `*value` + // while `nla_put()` copies it. + to_result(unsafe { bindings::nla_put(skb, attrtype, len, ptr) }) } /// Puts a `u32` attribute into the message.
--
2.55.0