[PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Sagar Taunk]

`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.

This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.

Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.

Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sagar Taunk <sagartaunk@proton.me>
---
Changes Since V3: 
Rebased on the upstream rust-next tree. 
No functional changes. 

 rust/kernel/net/netlink.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs
index 22ef3dde36fa..2f8733a694a9 100644
--- a/rust/kernel/net/netlink.rs
+++ b/rust/kernel/net/netlink.rs
@@ -11,6 +11,7 @@
 use kernel::{
     alloc::{self, AllocError},
     error::to_result,
+    num::casts::u16_as_usize,
     prelude::*,
     transmute::AsBytes,
     types::Opaque,
@@ -86,9 +87,17 @@ fn put<T>(&mut self, attrtype: c_int, value: &T) -> Result
     where
         T: ?Sized + AsBytes,
     {
+        // `nla_len` is a 16-bit field that encodes the total attribute length
+        // (header + payload). Subtracting the header size from `u16::MAX` gives
+        // the largest payload that still fits within that field.
+        const MAX_PAYLOAD_LEN: usize = u16_as_usize(u16::MAX) - size_of::<bindings::nlattr>();
+
         let skb = self.skb.skb.as_ptr();
         let len = size_of_val(value);
         let ptr = core::ptr::from_ref(value).cast::<c_void>();
+        if len > MAX_PAYLOAD_LEN {
+            return Err(EMSGSIZE);
+        }
         // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and the provided value is
         // readable and initialized for its `size_of` bytes.
         to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, ptr) })
-- 
2.55.0

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Alexandre Courbot]

On Wed Sep 23, 2026 at 9:05 PM JST, Sagar Taunk wrote:
> `put()` trusted an unchecked `as` cast from `usize` to `c_int`.
> When the length exceeds `i32::MAX` that cast wraps around to a
> negative value.
>
> This ultimately resulted in a kernel panic when the reinterpreted
> value via `__nla_reserve()` and `skb_put()` became enormous.
>
> Validate payload and header both fit together in a `u16`, rejecting
> any payload that wouldn't leave room for `NLA_HDRLEN`.
>
> Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> Signed-off-by: Sagar Taunk <sagartaunk@proton.me>

FWIW,

Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Carlos Llamas]

On Wed, Sep 23, 2026 at 12:05:17PM +0000, Sagar Taunk wrote:
> `put()` trusted an unchecked `as` cast from `usize` to `c_int`.
> When the length exceeds `i32::MAX` that cast wraps around to a
> negative value.
> 
> This ultimately resulted in a kernel panic when the reinterpreted
> value via `__nla_reserve()` and `skb_put()` became enormous.
> 
> Validate payload and header both fit together in a `u16`, rejecting
> any payload that wouldn't leave room for `NLA_HDRLEN`.
> 
> Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> Signed-off-by: Sagar Taunk <sagartaunk@proton.me>
> ---

LGTM,

Reviewed-by: Carlos Llamas <cmllamas@google.com>

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Gary Guo]

On Wed Sep 23, 2026 at 1:05 PM BST, Sagar Taunk wrote:
> `put()` trusted an unchecked `as` cast from `usize` to `c_int`.
> When the length exceeds `i32::MAX` that cast wraps around to a
> negative value.
> 
> This ultimately resulted in a kernel panic when the reinterpreted
> value via `__nla_reserve()` and `skb_put()` became enormous.
> 
> Validate payload and header both fit together in a `u16`, rejecting
> any payload that wouldn't leave room for `NLA_HDRLEN`.
> 
> Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction")
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> Signed-off-by: Sagar Taunk <sagartaunk@proton.me>

Reviewed-by: Gary Guo <gary@garyguo.net>

> ---
> Changes Since V3: 
> Rebased on the upstream rust-next tree. 
> No functional changes. 
> 
>  rust/kernel/net/netlink.rs | 9 +++++++++
>  1 file changed, 9 insertions(+)

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Jakub Kicinski]

On Wed, 23 Sep 2026 12:05:17 +0000 Sagar Taunk wrote:
> Rebased on the upstream rust-next tree. 

I'm confused, you're tagging this for net-next but rebasing 
on rust-next. This patch does not apply for us.
-- 
pw-bot: cr

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Sagar Taunk]

Sorry, my last patch was based on the rust-next tree so I thought it was not applying because I commited this on top of that so I just removed that and rebased on rust-next again. 

Am I supposed to rebase on this one? 
`https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/`






On Thursday, September 24th, 2026 at 11:16 PM, Jakub Kicinski <kuba@kernel.org> wrote:

> On Wed, 23 Sep 2026 12:05:17 +0000 Sagar Taunk wrote:
> > Rebased on the upstream rust-next tree.
> 
> I'm confused, you're tagging this for net-next but rebasing
> on rust-next. This patch does not apply for us.
> --
> pw-bot: cr
>

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Jakub Kicinski]

On Thu, 24 Sep 2026 18:02:24 +0000 Sagar Taunk wrote:
> Am I supposed to rebase on this one? 
> `https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/`

Yes, afaiu, and please don't top post

Re: [PATCH net-next v4] rust: net: netlink: validate attribute length before casting to `c_int`

[Andrew Lunn]

On Thu, Sep 24, 2026 at 06:02:24PM +0000, Sagar Taunk wrote:
> Sorry, my last patch was based on the rust-next tree so I thought it was not applying because I commited this on top of that so I just removed that and rebased on rust-next again. 
> 
> Am I supposed to rebase on this one? 
> `https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/`

There is some documentation here:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

which explains the two trees netdev has.

      Andrew