From nobody Fri Sep 25 12:05:54 2026 Received: from mail-4321.protonmail.ch (mail-4321.protonmail.ch [185.70.43.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED68D4854FC for ; Fri, 25 Sep 2026 09:35:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.70.43.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790328912; cv=none; b=ffWFJZGPoQyO7zPLgfEMfusoWHNy7sFcBz31id4I7sPjIMv0l2g033XIkyCir1u5psXkKYX1Fcg0jJiqZixBROR95ZaX0WcmllrYUtsRwNMUwoFfzWOUdzkGFK6QU5l8X/YQdFm4m/i67IF0A3pgT2QuRGv0nZzj/yfbQhyi1cU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790328912; c=relaxed/simple; bh=zL6QUn1TpvWtmYgwxcSIkriDKPEG/scU+3oxMlrKFZE=; h=Date:To:From:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=J+sGsPV3nGXkKdXM5dxqo61hu4GJqCLZQsvXwqA2tXsNx1Ce1UtRlwUXJKOr/nvap/o1XRapgF/cmRWPzUZA0uBsXd0L4FXi36bwWe6woPB67J1OrsWvPxY6sW/uqEeVlAb/QVjA33PiwoANSfqSHO8KlqjAs2R50fyUKBrs2hQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=proton.me; spf=pass smtp.mailfrom=proton.me; dkim=pass (2048-bit key) header.d=proton.me header.i=@proton.me header.b=SF9qMH9I; arc=none smtp.client-ip=185.70.43.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=proton.me Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=proton.me Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=proton.me header.i=@proton.me header.b="SF9qMH9I" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=protonmail; t=1790326509; x=1790585709; bh=zkohvUbYW8D1KYV9baP5FqoHLALhVh3cVlMGQa+d5Hw=; h=Date:To:From:Cc:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=SF9qMH9I82BQQ4bubbNt4y7V1oCvLulO2dx1qcoWcLRhVxeSNtW2CPxT4y/VZVbhg CmyEgABO5bYHHB38MpGVKDXLoK++o19for5m3lKUgx8enCqp6LwipmbTVz4m44N/D9 LAdog5N38pa0qCHIf129o7rrsdONFqPjXzEFUSkaEP1Sm36HWq4rXtRcODwcDYgdLm Qao+nJrBQx4jjCgVnCxQw2kv3lqAZgnF/IAYyHyv1Z6R7C47wPw9DbBzsgrhDnBYlS pcO/f46yrU83MUvfX3vZXxX9l5AnuOdV+J8dqdWc2P4aF0wzF/tlmRVByn1vtdiYB/ XqOqJkWqrKeXw== Date: Fri, 25 Sep 2026 08:55:04 +0000 To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Miguel Ojeda , Boqun Feng , Gary Guo , =?utf-8?Q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , Daniel Almeida , Tamir Duberstein , Alexandre Courbot , =?utf-8?Q?Onur_=C3=96zkan?= , Carlos Llamas , Matthew Maurer , Andrew Lunn , Greg Kroah-Hartman From: Sagar Taunk Cc: Sagar Taunk , netdev@vger.kernel.org, rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v6] rust: net: netlink: validate attribute length before casting to `c_int` Message-ID: <20260925085449.22553-1-sagartaunk@proton.me> Feedback-ID: 130121444:user:proton X-Pm-Message-ID: c5cf01b9f15066f4acb72ad7d1d2fa3474d02485 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" `put()` trusted an unchecked `as` cast from `usize` to `c_int`. When the length exceeds `i32::MAX` that cast wraps around to a negative value. This ultimately resulted in a kernel panic when the reinterpreted value via `__nla_reserve()` and `skb_put()` became enormous. Validate payload and header both fit together in a `u16`, rejecting any payload that wouldn't leave room for `NLA_HDRLEN`. Fixes: 5eaa5fbb6e6c ("rust: netlink: add raw netlink abstraction") Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Carlos Llamas Reviewed-by: Gary Guo Signed-off-by: Sagar Taunk --- changes since v5:=20 Rebased on net/main rust/kernel/net/netlink.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/rust/kernel/net/netlink.rs b/rust/kernel/net/netlink.rs index 22ef3dde36fa..2f8733a694a9 100644 --- a/rust/kernel/net/netlink.rs +++ b/rust/kernel/net/netlink.rs @@ -11,6 +11,7 @@ use kernel::{ alloc::{self, AllocError}, error::to_result, + num::casts::u16_as_usize, prelude::*, transmute::AsBytes, types::Opaque, @@ -86,9 +87,17 @@ fn put(&mut self, attrtype: c_int, value: &T) -> Resu= lt where T: ?Sized + AsBytes, { + // `nla_len` is a 16-bit field that encodes the total attribute le= ngth + // (header + payload). Subtracting the header size from `u16::MAX`= gives + // the largest payload that still fits within that field. + const MAX_PAYLOAD_LEN: usize =3D u16_as_usize(u16::MAX) - size_of:= :(); + let skb =3D self.skb.skb.as_ptr(); let len =3D size_of_val(value); let ptr =3D core::ptr::from_ref(value).cast::(); + if len > MAX_PAYLOAD_LEN { + return Err(EMSGSIZE); + } // SAFETY: `skb` is valid by `NetlinkSkBuff` type invariants, and = the provided value is // readable and initialized for its `size_of` bytes. to_result(unsafe { bindings::nla_put(skb, attrtype, len as c_int, = ptr) }) --=20 2.55.0