Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`
From: Sagar Taunk <hidden>
Date: 2026-09-22 02:31:40
Also in:
lkml, rust-for-linux
Subsystem:
networking [general], rust, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Miguel Ojeda, Linus Torvalds
Hello, are there any updates for this?
Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
Thanks,
Sagar Taunk
-------- Original Message --------
On Friday, 09/18/26 at 15:30 Sagar Taunk [off-list ref] wrote:
`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.
This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.
Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.
Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sagar Taunk <redacted>
---
rust/kernel/net/netlink.rs | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs
index a2f4bd171dcf..36f2e39c3ab7 100644
--- a/rust/kernel/net/netlink.rs
+++ b/rust/kernel/net/netlink.rs@@ -11,6 +11,7 @@ use kernel::{ alloc::{self, AllocError}, error::to_result, + num::casts::u16_as_usize, prelude::*, types::Opaque, ThisModule,
@@ -90,9 +91,17 @@ fn put<T>(&mut self, attrtype: c_int, value: &T) -> Result where T: ?Sized + IntoBytes + Immutable, { + // `nla_len` is a 16-bit field that encodes the total attribute length + // (header + payload). Subtracting the header size from `u16::MAX` gives + // the largest payload that still fits within that field. + const MAX_PAYLOAD_LEN: usize = u16_as_usize(u16::MAX) - size_of::<bindings::nlattr>(); + let skb = self.skb.skb.as_ptr(); let len = size_of_val(value); let ptr = core::ptr::from_ref(value).cast::<c_void>(); + if len > MAX_PAYLOAD_LEN { + return Err(EMSGSIZE); + } // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and the provided value is // readable and initialized for its `size_of` bytes. to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, ptr) }) --
2.55.0