Re: [PATCH net-next 2/6] tools: ynl: convert enum selector to string for sub-message parsing

On Fri, Sep 18, 2026 at 06:36:56AM +0000, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] ynl: NULL pointer dereference in generated sub-message parser
> --
> 
> commit fe174a522fe7b9577c0684fb882e6edfa773326f
> Author: Hangbin Liu <[email protected]>
> 
> tools: ynl: convert enum selector to string for sub-message parsing
>     
> YNL sub-message parsing expects a string selector for strcmp(). So for
> non-external enum selectors, convert the integer value to its string form
> via the family's {enum}_str() helper. This enables correct decoding of
> sub-messages keyed by enum values.
> 
> > diff --git a/tools/net/ynl/pyynl/ynl_gen_c.py b/tools/net/ynl/pyynl/ynl_gen_c.py
> > index 2b3483db1b60c..45bd7bc834b49 100755
> > --- a/tools/net/ynl/pyynl/ynl_gen_c.py
> > +++ b/tools/net/ynl/pyynl/ynl_gen_c.py
> > @@ -951,9 +951,17 @@ class TypeSubMessage(TypeNest):
> >              sel_var = f"_sel_{sel}"
> >          else:
> >              sel_var = f"{var}->{sel}"
> > +
> > +        parse_sel = sel_var
> > +        if not self.selector.is_external() and self.selector.attr and \
> > +           "enum" in self.selector.attr.attr:
> > +            enum_name = self.selector.attr.attr["enum"]
> > +            str_fn = c_lower(self.family.ident_name + "-" + enum_name) + "_str"
> > +            parse_sel = f"{str_fn}({sel_var})"
> > +
> >          get_lines = [f'if (!{sel_var})',
> >                       f'return ynl_submsg_failed(yarg, "{self.name}", "{selector}");',
> > -                     f"if ({self.nested_render_name}_parse(&parg, {sel_var}, attr))",
> > +                     f"if ({self.nested_render_name}_parse(&parg, {parse_sel}, attr))",
> 
> [Severity: High]
> Can this generated code cause a null pointer dereference in the user-space
> client when it communicates with a newer kernel?
> 
> The generated code checks if (!sel_var) first, which only catches a 0 value.
> However, if a non-zero unknown enum value is received, the auto-generated
> {enum}_str(sel_var) helper returns a null pointer.

Thanks, I will add a var to get the string first. And then check the new
parse_sel via 'if (!{parse_sel})'.

Hangbin