Re: [PATCH] RDMA/nldev: validate dynamic counter attribute length
From: yanjun.zhu <hidden>
Date: 2026-07-06 23:23:42
Also in:
lkml
On 7/6/26 2:12 AM, Pengpeng Hou wrote:
quoted hunk ↗ jump to hunk
From: Pengpeng <redacted> nldev_stat_set_counter_dynamic_doit() iterates nested hardware counter attributes and reads each entry with nla_get_u32(). The nested container proof does not by itself prove that each child attribute carries a four-byte payload. Reject hardware counter entries whose payload is shorter than a u32 before reading the index. Signed-off-by: Pengpeng <redacted> --- drivers/infiniband/core/nldev.c | 5 +++++ 1 file changed, 5 insertions(+)diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index 02a0a9c0a4a6..40b323131c7b 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c@@ -2133,6 +2133,11 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[], nla_for_each_nested(entry_attr, tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTERS], rem) { + if (nla_len(entry_attr) < sizeof(u32)) {
Maybe nla_len(entry_attr) > sizeof(u32) should also not be allowed? As such, nla_len(entry_attr) != sizeof(u32) should be better? Except the above, I am fine with this. Reviewed-by: Zhu Yanjun <redacted> Zhu Yanjun
+ ret = -EINVAL;
+ goto out;
+ }
+
index = nla_get_u32(entry_attr);
if ((index >= stats->num_counters) ||
!(stats->descs[index].flags & IB_STAT_FLAG_OPTIONAL)) {