On Mon, 11 Oct 2021 14:12:37 +0200 Daniel Borkmann wrote: > + if (ext & ~0) { > + NL_SET_ERR_MSG(extack, "Invalid extended flags"); > + goto out; > + } Could you also follow up and use NLA_POLICY_MASK() instead of validating in the code? It's probably less important for non-genl but still a good best practice.