From 4358a3e8e7cc986f3a589bc0251b7d6d73090faf Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Sat, 12 Sep 2026 16:43:36 -0700 Subject: [PATCH] netlink: specs: tcp_metrics: fix the attribute length checks TCP_FASTOPEN_COOKIE_MAX is the longest cookie we accept, not the shortest one. Cookies are even sized, from 4 bytes up, and the ones Linux itself generates are 8 bytes, so a 16 byte minimum declares all but the longest cookie invalid. The reference policy kept under #if 0 in tcp_metrics.c spells it as a maximum, which is what .len means for NLA_BINARY. The IPv6 addresses err the other way. The policy uses NLA_POLICY_EXACT_LEN() for both, so a request carrying a longer address is rejected with -ERANGE, even though the spec advertises 16 bytes as a mere minimum. Were the policy generated from this spec, as kernel-policy: global promises, the check would turn into NLA_POLICY_MIN_LEN() and start accepting over-long addresses, of which nla_get_in6_addr() would take the first 16 bytes. Nothing generated changes. fopen-cookie is reply-only so it never gets a policy entry, and exact-len only feeds the policy (and the fixed size array form, which needs a sub-type). Signed-off-by: Jakub Kicinski Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260912234337.308298-1-kuba@kernel.org Signed-off-by: Paolo Abeni --- Documentation/netlink/specs/tcp_metrics.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Documentation/netlink/specs/tcp_metrics.yaml b/Documentation/netlink/specs/tcp_metrics.yaml index 13144aeed31a..1d365908084d 100644 --- a/Documentation/netlink/specs/tcp_metrics.yaml +++ b/Documentation/netlink/specs/tcp_metrics.yaml @@ -32,7 +32,7 @@ attribute-sets: name: addr-ipv6 type: binary checks: - min-len: 16 + exact-len: 16 byte-order: big-endian display-hint: ipv6 - @@ -63,7 +63,7 @@ attribute-sets: name: fopen-cookie type: binary checks: - min-len: tcp-fastopen-cookie-max + max-len: tcp-fastopen-cookie-max - name: saddr-ipv4 type: u32 @@ -73,7 +73,7 @@ attribute-sets: name: saddr-ipv6 type: binary checks: - min-len: 16 + exact-len: 16 byte-order: big-endian display-hint: ipv6 -