diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-20 19:49:18 +0800 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-07-21 08:55:00 -0400 |
| commit | 74f49255492a62658f36bf2578d7916f1c6ffad1 (patch) | |
| tree | 98502cd8e28969fcd243616ece59d06d6e8cb42a /drivers/infiniband/core | |
| parent | 28a06de7318fad1d0dec9bf54fe04243cc0635ff (diff) | |
| download | linux-next-74f49255492a62658f36bf2578d7916f1c6ffad1.tar.gz linux-next-74f49255492a62658f36bf2578d7916f1c6ffad1.zip | |
RDMA/nldev: validate dynamic counter attribute length
RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are
consumed directly with nla_get_u32(). The top-level policy validates only
the container, so it does not establish the fixed shape of each child.
Require every child payload to be exactly one u32 before reading it.
Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260720114918.70323-1-pengpeng@iscas.ac.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/core')
| -rw-r--r-- | drivers/infiniband/core/nldev.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index aae4f3f6bcba..b1a6c1670091 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -2157,6 +2157,11 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[], nla_for_each_nested(entry_attr, tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTERS], rem) { + if (nla_len(entry_attr) != sizeof(u32)) { + ret = -EINVAL; + goto out; + } + index = nla_get_u32(entry_attr); if ((index >= stats->num_counters) || !(stats->descs[index].flags & IB_STAT_FLAG_OPTIONAL)) { |