RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are
consumed directly with nla_get_u32(). The top-level policy validates only
the container, so it does not establish the fixed shape of each child.

Require every child payload to be exactly one u32 before reading it.

Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260706091243.76784-1-pengpeng@iscas.ac.cn/
- require an exact u32 payload instead of only a minimum
- carry Zhu Yanjun's Reviewed-by
- rebase onto v7.2-rc4

 drivers/infiniband/core/nldev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 02a0a9c0a4a6..f0f09670956d 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -2133,6 +2133,11 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[],
 
 	nla_for_each_nested(entry_attr, tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTERS],
 			    rem) {
+		if (nla_len(entry_attr) != sizeof(u32)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
 		index = nla_get_u32(entry_attr);
 		if ((index >= stats->num_counters) ||
 		    !(stats->descs[index].flags & IB_STAT_FLAG_OPTIONAL)) {

On Mon, 20 Jul 2026 19:49:18 +0800, Pengpeng Hou wrote:
> RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are
> consumed directly with nla_get_u32(). The top-level policy validates only
> the container, so it does not establish the fixed shape of each child.
> 
> Require every child payload to be exactly one u32 before reading it.
> 
> 
> [...]

Applied, thanks!

[1/1] RDMA/nldev: validate dynamic counter attribute length
      https://git.kernel.org/rdma/rdma/c/74f49255492a62

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>