From patchwork Mon Jul 31 12:13:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lin Ma X-Patchwork-Id: 128644 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:918b:0:b0:3e4:2afc:c1 with SMTP id s11csp1978064vqg; Mon, 31 Jul 2023 05:25:08 -0700 (PDT) X-Google-Smtp-Source: APBJJlH8jN8X4PXM3totNKL5CPvZQ8p03VLNVO7IydNkH2WBaTjxNj2MFnM9ExHL2qOEDYb3V5Q/ X-Received: by 2002:a05:6808:23d4:b0:3a7:3881:d6f4 with SMTP id bq20-20020a05680823d400b003a73881d6f4mr2503566oib.35.1690806307729; Mon, 31 Jul 2023 05:25:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690806307; cv=none; d=google.com; s=arc-20160816; b=N855t3zfbxmeElCRRk/VW/xZNusTzyFMD3ZpushwMB2Dmq8kEAdb66CBnIBmJE6+Uw Vur9osVihQKpleNYynPa3rhJefYThTuSfDZ9yZ8qC6H3OGKQAjKmA+9c+hMxjgZM/HfW dx+0tMAj/z/olpGCMqprUy7MyKYfRrynFDKdwdFeisWNealnh3Cqow33KEujNxJ+mOim b768iL/Pi/xUZ4lSnoJhOLpXcb30aufZXe00MLQa7YnCtEo+yOC13JS4UUd2XNynbOC8 4RvvJ4XAL91hrrjXnNOw8y6rCQU77MehABF4b/WkGsgPi5fQvvgpgabv+NppjAeWn3/2 9GXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:subject:to:from; bh=o897qQmwOG/R5ATPz1Y/i3aALw3m5ORO0CxbZHETdLA=; fh=iiRMkQV9Qsmq5ccdcnx7Z8UynCdxCzxcOD536FcAHag=; b=s74mlh886NVs0UPWIwUPQ4ZhGup/MZqwJAX6TcHfZde9VYpcJZ5VomDTu9iLiS5ekl Koonsd3Z8HGSFNchpisbiZlPNlxOCPJYW4ZIlvFJVC1NCoHP4vA38ABQVhdZ2CvMF0gn PUxULRGgrmOn71CIOJ0pdzG4o6OCA2c8XPiMauzNvJssOMAXVn6x3fDK/lKgdJ3yR27T DB9ahSodjp13Ht7v4IeFGkrCQ19DyoD+BaykN9efV1MWrHBa35VM6epvQkbXFfHF1Smw kBedMlbhwXmrU+egiSjtwHC9zhxB14owJOltH5Av/KESWNhegUVWViZ02W5sdqp7mkCb UH2Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h2-20020a635302000000b0055c872695a3si225842pgb.447.2023.07.31.05.24.54; Mon, 31 Jul 2023 05:25:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231194AbjGaMOC (ORCPT + 99 others); Mon, 31 Jul 2023 08:14:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231881AbjGaMOA (ORCPT ); Mon, 31 Jul 2023 08:14:00 -0400 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 6A76210E3; Mon, 31 Jul 2023 05:13:57 -0700 (PDT) Received: from localhost.localdomain (unknown [125.120.146.22]) by mail-app2 (Coremail) with SMTP id by_KCgCXn4tlpcdkEBfaCg--.57020S4; Mon, 31 Jul 2023 20:13:25 +0800 (CST) From: Lin Ma To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, fw@strlen.de, yang.lee@linux.alibaba.com, jgg@ziepe.ca, markzhang@nvidia.com, phaddad@nvidia.com, yuancan@huawei.com, linma@zju.edu.cn, ohartoov@nvidia.com, chenzhongjin@huawei.com, aharonl@nvidia.com, leon@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org Subject: [PATCH net v1 2/2] RDMA/nldev: specify the nested length of RDMA_NLDEV_ATTR_STAT_HWCOUNTERS Date: Mon, 31 Jul 2023 20:13:24 +0800 Message-Id: <20230731121324.3973136-1-linma@zju.edu.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: by_KCgCXn4tlpcdkEBfaCg--.57020S4 X-Coremail-Antispam: 1UD129KBjvJXoW7urykAw4Uuw1Dur45JF43Wrg_yoW8Wryrpa yqyFy2ka43GF1jkw1qyFWkWrWa9wnxZr9rGanFg343Cwn8Xwn7W342kr1vvaykt34UJ397 Jr1UC347CFyqkr7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvG14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4U JVW0owA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUGVWUXwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCY02Avz4vE14v_Xr1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr 0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY 17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcV C0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY 6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa 73UjIFyTuYvjfUOeOJUUUUU X-CM-SenderInfo: qtrwiiyqvtljo62m3hxhgxhubq/ X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772938914947847822 X-GMAIL-MSGID: 1772938914947847822 The nla_for_each_nested parsing in function nldev_stat_set_counter_dynamic_doit() does not check the length of the attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 4 byte integer. This patch leverages the newly introduced NLA_POLICY_NESTED_NO_TYPE which sets the len field in nla_policy and allows the nlmsg_parse in function nldev_stat_set_doit checks the nested length. Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink") Signed-off-by: Lin Ma --- drivers/infiniband/core/nldev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index d5d3e4f0de77..c33eacc18d97 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -145,7 +145,7 @@ static const struct nla_policy nldev_policy[RDMA_NLDEV_ATTR_MAX] = { [RDMA_NLDEV_ATTR_STAT_COUNTER] = { .type = NLA_NESTED }, [RDMA_NLDEV_ATTR_STAT_COUNTER_ENTRY] = { .type = NLA_NESTED }, [RDMA_NLDEV_ATTR_STAT_COUNTER_ID] = { .type = NLA_U32 }, - [RDMA_NLDEV_ATTR_STAT_HWCOUNTERS] = { .type = NLA_NESTED }, + [RDMA_NLDEV_ATTR_STAT_HWCOUNTERS] = NLA_POLICY_NESTED_NO_TYPE(sizeof(u32)), [RDMA_NLDEV_ATTR_STAT_HWCOUNTER_ENTRY] = { .type = NLA_NESTED }, [RDMA_NLDEV_ATTR_STAT_HWCOUNTER_ENTRY_NAME] = { .type = NLA_NUL_STRING }, [RDMA_NLDEV_ATTR_STAT_HWCOUNTER_ENTRY_VALUE] = { .type = NLA_U64 },