Re: [PATCH] audit: use copied skb length in kauditd_send_multicast_skb()

[Bradley Morgan]

On 10 August 2026 16:19:10 BST, Ricardo Robaina <rrobaina@xxxxxxxxxx>
wrote:
>On Mon, Aug 10, 2026 at 10:32 AM Bradley Morgan <include@xxxxxxxxx> wrote:
>>
>> Hi Ricardo,
>>
>> > -     nlh->nlmsg_len = skb->len;
>> > +     nlh->nlmsg_len = copy->len;
>>
>> Fine. skb_copy() does skb_put(n, skb->len) and nothing touches
>> copy->len in between, so the two are always identical.
>> Which is also why "safer" is a bit of a stretch, it prevents nothing.
>> Feel free to bikeshed the changelog wording on that.
>>
>
>Thanks for reviewing this patch, Bradley. I agree with you on the wording.
>

np.

>> If you ever want a more interesting cleanup here, the real quirk is
>> the line above: the unicast path sets nlmsg_len to skb->len minus
>> NLMSG_HDRLEN, this one uses the full length.
>
>That's interesting, maybe moving the nlmsg_len fixup out of
>__audit_log_end() would be better. I'll look into it.
>

Hmmm.. perhaps it will. I will suggest a fix: