The netlink attribute length field nla_len is a __u16, which can only represent values up to 65535 bytes. NICs with a large number of statistics strings (e.g. mlx5_core with thousands of ETH_SS_STATS entries) can produce a ETHTOOL_A_STRINGSET_STRINGS nest that exceeds this limit. When nla_nest_end() writes the actual nest size back to nla_len, the value is silently truncated. This results in a corrupted netlink message being sent to userspace: the parser reads a wrong (truncated) attribute length and misaligns all subsequent attribute boundaries, causing decode errors. Fix this by checking whether the size of strings_attr would exceed U16_MAX after all strings have been written, and give up nla put if so. Signed-off-by: Hangbin Liu --- net/ethtool/strset.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ethtool/strset.c b/net/ethtool/strset.c index f6a67109beda..9c502b290f5c 100644 --- a/net/ethtool/strset.c +++ b/net/ethtool/strset.c @@ -441,6 +441,10 @@ static int strset_fill_set(struct sk_buff *skb, if (strset_fill_string(skb, set_info, i) < 0) goto nla_put_failure; } + + if (skb_tail_pointer(skb) - (unsigned char *)strings_attr > U16_MAX) + goto nla_put_failure; + nla_nest_end(skb, strings_attr); } -- Git-155)