When NL_SET_ERR_MSG is called more than once on the same extack, the
existing message is silently overwritten. This is hard to detect via
static analysis. Emit a rate-limited warning so these cases become
visible.

Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 include/linux/netlink.h | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 882e9c1b6c1d..f6538304745f 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -90,6 +90,13 @@ struct netlink_ext_ack {
 	char _msg_buf[NETLINK_MAX_FMTMSG_LEN];
 };
 
+#define __NL_SET_MSG(__extack, __msg) do {			\
+	if (__extack->_msg)					\
+		net_warn_ratelimited("overriding extack: %s",	\
+				     __extack->_msg);		\
+	__extack->_msg = __msg;					\
+} while (0)
+
 /* Always use this macro, this allows later putting the
  * message into a separate section or such for things
  * like translation or listing all possible messages.
@@ -102,7 +109,7 @@ struct netlink_ext_ack {
 	do_trace_netlink_extack(__msg);			\
 							\
 	if (__extack)					\
-		__extack->_msg = __msg;			\
+		__NL_SET_MSG(__extack, __msg);		\
 } while (0)
 
 /* We splice fmt with %s at each end even in the snprintf so that both calls
@@ -121,7 +128,7 @@ struct netlink_ext_ack {
 									       \
 	do_trace_netlink_extack(__extack->_msg_buf);			       \
 									       \
-	__extack->_msg = __extack->_msg_buf;				       \
+	__NL_SET_MSG(__extack, __extack->_msg_buf);			       \
 } while (0)
 
 #define NL_SET_ERR_MSG_MOD(extack, msg)			\
@@ -156,7 +163,7 @@ struct netlink_ext_ack {
 	do_trace_netlink_extack(__msg);				\
 								\
 	if (__extack) {						\
-		__extack->_msg = __msg;				\
+		__NL_SET_MSG(__extack, __msg);			\
 		__extack->bad_attr = (attr);			\
 		__extack->policy = (pol);			\
 	}							\
@@ -176,7 +183,7 @@ struct netlink_ext_ack {
 										\
 	do_trace_netlink_extack(__extack->_msg_buf);				\
 										\
-	__extack->_msg = __extack->_msg_buf;					\
+	__NL_SET_MSG(__extack, __extack->_msg_buf);				\
 	__extack->bad_attr = (attr);						\
 	__extack->policy = (pol);						\
 } while (0)
-- 
2.53.0

On Wed, 13 May 2026 22:32:16 +0800 David Yang wrote:
> When NL_SET_ERR_MSG is called more than once on the same extack, the
> existing message is silently overwritten. This is hard to detect via
> static analysis. Emit a rate-limited warning so these cases become
> visible.

I don't think this is worth the bloat.
There's only so much we can do for poorly written code.
-- 
pw-bot: reject