kernel/linux.git/drivers/net/netconsole.c, branch v6.12.92

netconsole: propagate device name truncation in dev_name_store()

2026-05-23T11:04:56+00:00

[ Upstream commit 92ceb7bff62c2606f664c204750eca0b85d44112 ] dev_name_store() calls strscpy(nt->np.dev_name, buf, IFNAMSIZ) without checking the return value. If userspace writes an interface name longer than IFNAMSIZ - 1, strscpy() silently truncates and returns -E2BIG, but the function ignores it and reports a fully successful write back to userspace. If a real interface happens to match the truncated name, netconsole will bind to the wrong device on the next enable, sending kernel logs and panic output to an unintended network segment with no indication to userspace that anything was rewritten. Reject writes whose length cannot fit in nt->np.dev_name up front: if (count >= IFNAMSIZ) return -ENAMETOOLONG; This is not a big deal of a problem, but, it is still the correct approach. Fixes: 0bcc1816188e57 ("[NET] netconsole: Support dynamic reconfiguration using configfs") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-3-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

net, treewide: define and use MAC_ADDR_STR_LEN

2026-05-23T11:04:54+00:00

[ Upstream commit 6d6c1ba7824022528dbe3e283fafbd0775424128 ] There are a few places in the tree which compute the length of the string representation of a MAC address as 3 * ETH_ALEN - 1. Define a constant for this and use it where relevant. No functionality changes are expected. Signed-off-by: Uday Shankar Reviewed-by: Michal Swiatkowski Acked-by: Johannes Berg Reviewed-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250312-netconsole-v6-1-3437933e79b8@purestorage.com Signed-off-by: Paolo Abeni Stable-dep-of: 3bc179bc7146 ("netpoll: fix IPv6 local-address corruption") Signed-off-by: Sasha Levin

netconsole: avoid out-of-bounds access on empty string in trim_newline()

2026-05-07T04:09:33+00:00

commit 7079c8c13f2d33992bc846240517d88f4ab07781 upstream. trim_newline() unconditionally dereferences s[len - 1] after computing len = strnlen(s, maxlen). When the string is empty, len is 0 and the expression underflows to s[(size_t)-1], reading (and potentially writing) one byte before the buffer. The two callers feed trim_newline() with the result of strscpy() from configfs store callbacks (dev_name_store, userdatum_value_store). configfs guarantees count >= 1 reaches the callback, but the byte itself can be NUL: a userspace write(fd, "\0", 1) leaves the destination empty after strscpy() and triggers the underflow. The OOB write only fires if the adjacent byte happens to be '\n', so this is not a security issue, but the access is undefined behaviour either way. This pattern is commonly flagged by LLM-based code reviewers. While it is not a security fix, the underlying access is undefined behaviour and the change is small and self-contained, so it is a reasonable candidate for the stable trees. Guard the dereference on a non-zero length. Fixes: ae001dc67907 ("net: netconsole: move newline trimming to function") Cc: stable@vger.kernel.org Signed-off-by: Breno Leitao Reviewed-by: Gustavo Luiz Duarte Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-netcons_trim_newline-v1-1-dc35889aeedf@debian.org Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman

net: netconsole: fix wrong warning

2024-10-10T02:42:43+00:00

A warning is triggered when there is insufficient space in the buffer for userdata. However, this is not an issue since userdata will be sent in the next iteration. Current warning message: ------------[ cut here ]------------ WARNING: CPU: 13 PID: 3013042 at drivers/net/netconsole.c:1122 write_ext_msg+0x3b6/0x3d0 ? write_ext_msg+0x3b6/0x3d0 console_flush_all+0x1e9/0x330 The code incorrectly issues a warning when this_chunk is zero, which is a valid scenario. The warning should only be triggered when this_chunk is negative. Fixes: 1ec9daf95093 ("net: netconsole: append userdata to fragmented netconsole messages") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20241008094325.896208-1-leitao@debian.org Signed-off-by: Jakub Kicinski

net: netconsole: Populate dynamic entry even if netpoll fails

2024-08-26T16:25:44+00:00

Currently, netconsole discards targets that fail during initialization, causing two issues: 1) Inconsistency between target list and configfs entries * user pass cmdline0, cmdline1. If cmdline0 fails, then cmdline1 becomes cmdline0 in configfs. 2) Inability to manage failed targets from userspace * If user pass a target that fails with netpoll (interface not loaded at netcons initialization time, such as interface is a module), then the target will not exist in the configfs, so, user cannot re-enable or modify it from userspace. Failed targets are now added to the target list and configfs, but remain disabled until manually enabled or reconfigured. This change does not change the behaviour if CONFIG_NETCONSOLE_DYNAMIC is not set. CC: Aijay Adams Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20240822111051.179850-3-leitao@debian.org Signed-off-by: Jakub Kicinski

net: netconsole: Constify struct config_item_type

2024-08-14T02:12:14+00:00

'struct config_item_type' is not modified in this driver. This structure is only used with config_group_init_type_name() which takes a const struct config_item_type* as a 3rd argument. This also makes things consistent with 'netconsole_target_type' witch is already const. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 33007 3952 1312 38271 957f drivers/net/netconsole.o After: ===== text data bss dec hex filename 33071 3888 1312 38271 957f drivers/net/netconsole.o Signed-off-by: Christophe JAILLET Reviewed-by: Breno Leitao Link: https://patch.msgid.link/9c205b2b4bdb09fc9e9d2cb2f2936ec053da1b1b.1723325900.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski

net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal

2024-08-13T08:58:58+00:00

Current issue: - The `target_list_lock` spinlock is held while iterating over target_list() entries. - Mid-loop, the lock is released to call __netpoll_cleanup(), then reacquired. - This practice compromises the protection provided by `target_list_lock`. Reason for current design: 1. __netpoll_cleanup() may sleep, incompatible with holding a spinlock. 2. target_list_lock must be a spinlock because write_msg() cannot sleep. (See commit b5427c27173e ("[NET] netconsole: Support multiple logging targets")) Defer the cleanup of the netpoll structure to outside the target_list_lock() protected area. Create another list (target_cleanup_list) to hold the entries that need to be cleaned up, and clean them using a mutex (target_cleanup_list_lock). Signed-off-by: Breno Leitao Signed-off-by: Paolo Abeni

net: netconsole: Unify Function Return Paths

2024-08-13T08:58:58+00:00

The return flow in netconsole's dynamic functions is currently inconsistent. This patch aims to streamline and standardize the process by ensuring that the mutex is unlocked before returning the ret value. Additionally, this update includes a minor functional change where certain strnlen() operations are performed with the dynamic_netconsole_mutex locked. This adjustment is not anticipated to cause any issues, however, it is crucial to document this change for clarity. Signed-off-by: Breno Leitao Signed-off-by: Paolo Abeni

net: netconsole: Standardize variable naming

2024-08-13T08:58:58+00:00

Update variable names from err to ret in cases where the variable may return non-error values. This change facilitates a forthcoming patch that relies on ret being used consistently to handle return values, regardless of whether they indicate an error or not. Signed-off-by: Breno Leitao Signed-off-by: Paolo Abeni

net: netconsole: Correct mismatched return types

2024-08-13T08:58:58+00:00

netconsole incorrectly mixes int and ssize_t types by using int for return variables in functions that should return ssize_t. This is fixed by updating the return variables to the appropriate ssize_t type, ensuring consistency across the function definitions. Signed-off-by: Breno Leitao Signed-off-by: Paolo Abeni