netconsole: restore userdatum value on update_userdata() failure

userdatum_value_store() updates udm->value first and only then calls
update_userdata() to rebuild the on-the-wire payload. If
update_userdata() fails (e.g. -ENOMEM from kmalloc), the function
returns the error to userspace, but udm->value already holds the new
string while the live nt->userdata buffer still reflects the old one.

The next successful write to any sibling userdatum on the same target
will call update_userdata() again, which walks every entry and packs
the now-stale udm->value into the payload. The failed write is thus
silently activated later, with no indication to userspace that the
value it tried to set was rejected.

Snapshot the previous value before overwriting udm->value and restore
it if update_userdata() fails so the visible state and the active
payload stay consistent.

Fixes: eb83801af2dc ("netconsole: Dynamic allocation of userdata buffer")
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-4-59965f29d9cc@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index b3b36e3ddd03db80c913c6538dccaa283d57bf88..57dd6821a8aa908c2888d84286c2884bd54b5275 100644 (file)
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -1079,6 +1079,7 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
                                     size_t count)
 {
        struct userdatum *udm = to_userdatum(item);
+       char old_value[MAX_EXTRADATA_VALUE_LEN];
        struct netconsole_target *nt;
        struct userdata *ud;
        ssize_t ret;
@@ -1088,6 +1089,8 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
 
        mutex_lock(&netconsole_subsys.su_mutex);
        dynamic_netconsole_mutex_lock();
+       /* Snapshot for rollback if update_userdata() fails below */
+       strscpy(old_value, udm->value, sizeof(old_value));
        /* count is bounded above, so strscpy() cannot truncate here */
        strscpy(udm->value, buf, sizeof(udm->value));
        trim_newline(udm->value, sizeof(udm->value));
@@ -1095,8 +1098,11 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
        ud = to_userdata(item->ci_parent);
        nt = userdata_to_target(ud);
        ret = update_userdata(nt);
-       if (ret < 0)
+       if (ret < 0) {
+               /* Restore the previous value so it matches the live payload */
+               strscpy(udm->value, old_value, sizeof(udm->value));
                goto out_unlock;
+       }
        ret = count;
 out_unlock:
        dynamic_netconsole_mutex_unlock();