[PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Sagar Taunk]

`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.

This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.

Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.

Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")

Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sagar Taunk <sagartaunk@proton.me>
---
 rust/kernel/net/netlink.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs
index a2f4bd171dcf..36f2e39c3ab7 100644
--- a/rust/kernel/net/netlink.rs
+++ b/rust/kernel/net/netlink.rs
@@ -11,6 +11,7 @@
 use kernel::{
     alloc::{self, AllocError},
     error::to_result,
+    num::casts::u16_as_usize,
     prelude::*,
     types::Opaque,
     ThisModule,
@@ -90,9 +91,17 @@ fn put<T>(&mut self, attrtype: c_int, value: &T) -> Result
     where
         T: ?Sized + IntoBytes + Immutable,
     {
+        // `nla_len` is a 16-bit field that encodes the total attribute length
+        // (header + payload). Subtracting the header size from `u16::MAX` gives
+        // the largest payload that still fits within that field.
+        const MAX_PAYLOAD_LEN: usize = u16_as_usize(u16::MAX) - size_of::<bindings::nlattr>();
+
         let skb = self.skb.skb.as_ptr();
         let len = size_of_val(value);
         let ptr = core::ptr::from_ref(value).cast::<c_void>();
+        if len > MAX_PAYLOAD_LEN {
+            return Err(EMSGSIZE);
+        }
         // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and the provided value is
         // readable and initialized for its `size_of` bytes.
         to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, ptr) })
-- 
2.55.0

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Sagar Taunk]

Hello, are there any updates for this?

Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
Thanks,
Sagar Taunk

-------- Original Message --------
On Friday, 09/18/26 at 15:30 Sagar Taunk <sagartaunk@proton.me> wrote:
`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.

This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.

Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.

Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")

Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sagar Taunk <sagartaunk@proton.me>
---
 rust/kernel/net/netlink.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs
index a2f4bd171dcf..36f2e39c3ab7 100644
--- a/rust/kernel/net/netlink.rs
+++ b/rust/kernel/net/netlink.rs
@@ -11,6 +11,7 @@
 use kernel::{
     alloc::{self, AllocError},
     error::to_result,
+    num::casts::u16_as_usize,
     prelude::*,
     types::Opaque,
     ThisModule,
@@ -90,9 +91,17 @@ fn put<T>(&mut self, attrtype: c_int, value: &T) -> Result
     where
         T: ?Sized + IntoBytes + Immutable,
     {
+        // `nla_len` is a 16-bit field that encodes the total attribute length
+        // (header + payload). Subtracting the header size from `u16::MAX` gives
+        // the largest payload that still fits within that field.
+        const MAX_PAYLOAD_LEN: usize = u16_as_usize(u16::MAX) - size_of::<bindings::nlattr>();
+
         let skb = self.skb.skb.as_ptr();
         let len = size_of_val(value);
         let ptr = core::ptr::from_ref(value).cast::<c_void>();
+        if len > MAX_PAYLOAD_LEN {
+            return Err(EMSGSIZE);
+        }
         // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and the provided value is
         // readable and initialized for its `size_of` bytes.
         to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, ptr) })
--
2.55.0

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Alice Ryhl]

On Tue, Sep 22, 2026 at 4:31 AM Sagar Taunk <sagartaunk@proton.me> wrote:
>
>
>
>
> Hello, are there any updates for this?
>
> Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)

You already added my Reviewed-by, and I'm ok with the patch, so for
now we're just waiting for netdev to pick it up.

You're welcome to patch things pointed out by sashiko if they're real
issues. But note that sashiko can make mistakes, so if you're not sure
that something is a bug, it may be better to ask first.

Alice

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Paolo Abeni]

On 9/22/26 04:31, Sagar Taunk wrote:
> Hello, are there any updates for this?
> 
> Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
Does not apply cleanly to net. Since a repost is needed, you must
also avoid empty lines in the tag area (i.e. after the fixes tag).

WRT sashiko-reported issues, beyond be aware of false-positives,
generally speaking net-next is the preferred target tree (i.e. no
or very limited impact, very old issue, etc...) with no fixes tag.

Focusing on high stakes changes would be appreciated.

/P

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Alice Ryhl]

On Tue, Sep 22, 2026 at 3:36 PM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 9/22/26 04:31, Sagar Taunk wrote:
> > Hello, are there any updates for this?
> >
> > Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
> Does not apply cleanly to net. Since a repost is needed, you must
> also avoid empty lines in the tag area (i.e. after the fixes tag).
>
> WRT sashiko-reported issues, beyond be aware of false-positives,
> generally speaking net-next is the preferred target tree (i.e. no
> or very limited impact, very old issue, etc...) with no fixes tag.
>
> Focusing on high stakes changes would be appreciated.

From my perspective there's no issue in landing this through net-next
instead of net, as it's not urgent.

Alice

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Sagar Taunk]

Should I resend it after rebasing it or would this be fine as is ?


-------- Original Message --------
On Tuesday, 09/22/26 at 19:12 Alice Ryhl <aliceryhl@google.com> wrote:
On Tue, Sep 22, 2026 at 3:36 PM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 9/22/26 04:31, Sagar Taunk wrote:
> > Hello, are there any updates for this?
> >
> > Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
> Does not apply cleanly to net. Since a repost is needed, you must
> also avoid empty lines in the tag area (i.e. after the fixes tag).
>
> WRT sashiko-reported issues, beyond be aware of false-positives,
> generally speaking net-next is the preferred target tree (i.e. no
> or very limited impact, very old issue, etc...) with no fixes tag.
>
> Focusing on high stakes changes would be appreciated.

From my perspective there's no issue in landing this through net-next
instead of net, as it's not urgent.

Alice

Re: [PATCH net v3] rust: net: netlink: validate attribute length before casting to `c_int`

[Alice Ryhl]

On Wed, Sep 23, 2026 at 10:07 AM Sagar Taunk <sagartaunk@proton.me> wrote:
>
> Should I resend it after rebasing it or would this be fine as is ?

Please resend targeting 'net-next' instead of 'net' and resend with a
rebase. Thanks!

Also, please read the guidelines on top-posting:
https://docs.kernel.org/process/submitting-patches.html#use-trimmed-interleaved-replies-in-email-discussions

> -------- Original Message --------
> On Tuesday, 09/22/26 at 19:12 Alice Ryhl <aliceryhl@google.com> wrote:
> On Tue, Sep 22, 2026 at 3:36 PM Paolo Abeni <pabeni@redhat.com> wrote:
> >
> > On 9/22/26 04:31, Sagar Taunk wrote:
> > > Hello, are there any updates for this?
> > >
> > > Also, I wanted to ask is it fine if I keep fixing stuff pointed out by sashiko for now ? (I.e pre-existing issues pointed out by it in other's patches or should I ask the original authors of it first ?)
> > Does not apply cleanly to net. Since a repost is needed, you must
> > also avoid empty lines in the tag area (i.e. after the fixes tag).
> >
> > WRT sashiko-reported issues, beyond be aware of false-positives,
> > generally speaking net-next is the preferred target tree (i.e. no
> > or very limited impact, very old issue, etc...) with no fixes tag.
> >
> > Focusing on high stakes changes would be appreciated.
>
> From my perspective there's no issue in landing this through net-next
> instead of net, as it's not urgent.
>
> Alice
>