Thread (7 messages) flat view 7 messages, 3 authors, 4d ago

net: parsing IFLA_INET_CONF broken since 7.1 if NLA_F_NESTED not set

From: Quentin Armitage <hidden>
Date: 2026-09-14 14:22:18
Subsystem: networking [general], networking [ipv4/ipv6], the rest · Maintainers: "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds

Commit fa8fca88714c - "ipv4: validate IPV4_DEVCONF attributes properly" changed
inet_validate_link_af() to call nla_parse_nested() rather than
nla_for_each_nested() for IFLA_INET_CONF. A side effect of this change is that
the code now checks that NLA_F_NESTED is set for IFLA_INET_CONF, and rejects the
message if it is not, whereas previously there was no check for NLA_F_NESTED
being set.

The consequence of this is that code which worked prior to Linux 7.1, albeit
erroneously not setting NLA_F_NESTED now fails.

In order to maintain backward compatibility, rather than calling
nla_parse_nested(), nla_parse_nested_deprecated() should be called, as it is
earlier in the function.

FWIW the following patch makes the change.

commit 5f372809f2f07fe7ed5b91b4293945e8a7fd343b
Author: Quentin Armitage [off-list ref]
Date:   Mon Sep 14 15:10:42 2026 +0100

    net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
    
    Commit fa8fca88714c - "ipv4: validate IPV4_DEVCONF attributes properly"
    added validation of IFLA_INET_CONF attributes, and in the process
    changed the call of nla_for_each_nested() to nla_parse_nested(). A
    side effect of this change is that the IFLA_INET_CONF option is now
    tested for NLA_F_NESTED being set, and fails if it is not. Prior to the
    commit there was no check of NLA_F_NESTED.
    
    Changing nla_parse_nested() to nla_parse_nested_decrecated() restores
    the previous functionality of not checking for NLA_F_NESTED, thereby
    allowing code that (incorrectly) doesn't set NLA_F_NESTED to continue to
    work.
    
    Signed-off-by: Quentin Armitage [off-list ref]
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a90be57c63be..2bb7b1c7565e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2117,9 +2117,10 @@ static int inet_validate_link_af(const struct net_device
*dev,
 		return err;
 
 	if (tb[IFLA_INET_CONF]) {
-		err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX,
-				       tb[IFLA_INET_CONF], inet_devconf_policy,
-				       extack);
+		err = nla_parse_nested_deprecated(nested_tb, IPV4_DEVCONF_MAX,
+						  tb[IFLA_INET_CONF],
+						  inet_devconf_policy,
+						  extack);
 
 		if (err < 0)
 			return err;
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help