[PATCH] net/sched: ematch: check nla_put_nohdr() return value in tcf_em_tree_dump()

[PATCH] net/sched: ematch: check nla_put_nohdr() return value in tcf_em_tree_dump()

[Hui Peng]

When tcf_em_tree_dump() was converted from the legacy rtnetlink
`RTA_PUT_NOHDR` macro (which contained an implicit `goto
rtattr_failure;`) to `nla_put_nohdr()`, the return value check on
`nla_put_nohdr()` was omitted for container/simple matches and raw match
payloads.

If the netlink dump skb runs out of tailroom at `nla_put_nohdr()`, the
error is silently ignored and `match_start->nla_len` is finalized
without the match payload, emitting a malformed/truncated
TCA_EMATCH_TREE_LIST attribute to userspace instead of returning `-1`
via `nla_put_failure` so rtnetlink can reallocate and retry the dump.

Check the return value of `nla_put_nohdr()` in both branches and jump to
`nla_put_failure` on error.

Fixes: add93b610a4e ("[NET_SCHED]: Convert classifiers from rtnetlink to new netlink API")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/sched/ematch.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 5c1235e6076a..563feb1011f2 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -470,9 +470,12 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
 				goto nla_put_failure;
 		} else if (tcf_em_is_container(em) || tcf_em_is_simple(em)) {
 			u32 u = em->data;
-			nla_put_nohdr(skb, sizeof(u), &u);
-		} else if (em->datalen > 0)
-			nla_put_nohdr(skb, em->datalen, (void *) em->data);
+			if (nla_put_nohdr(skb, sizeof(u), &u))
+				goto nla_put_failure;
+		} else if (em->datalen > 0) {
+			if (nla_put_nohdr(skb, em->datalen, (void *)em->data))
+				goto nla_put_failure;
+		}
 
 		tail = skb_tail_pointer(skb);
 		match_start->nla_len = tail - (u8 *)match_start;
-- 
2.55.0.1082.g2b9226bbc0-goog

Re: [PATCH] net/sched: ematch: check nla_put_nohdr() return value in tcf_em_tree_dump()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat, 19 Sep 2026 21:06:24 +0000 you wrote:
> When tcf_em_tree_dump() was converted from the legacy rtnetlink
> `RTA_PUT_NOHDR` macro (which contained an implicit `goto
> rtattr_failure;`) to `nla_put_nohdr()`, the return value check on
> `nla_put_nohdr()` was omitted for container/simple matches and raw match
> payloads.
> 
> If the netlink dump skb runs out of tailroom at `nla_put_nohdr()`, the
> error is silently ignored and `match_start->nla_len` is finalized
> without the match payload, emitting a malformed/truncated
> TCA_EMATCH_TREE_LIST attribute to userspace instead of returning `-1`
> via `nla_put_failure` so rtnetlink can reallocate and retry the dump.
> 
> [...]

Here is the summary with links:
  - net/sched: ematch: check nla_put_nohdr() return value in tcf_em_tree_dump()
    https://git.kernel.org/netdev/net-next/c/528de6832b21

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html