diff mbox

[for-3.11,2/3] rdma/cm: Fix accessing invalid private data for UD

Message ID 1374703569-16668-3-git-send-email-sean.hefty@intel.com (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Hefty, Sean July 24, 2013, 10:06 p.m. UTC 
From: Sean Hefty <sean.hefty@intel.com>

If a application is using AF_IB with a UD QP, but does not
provide any private data, we will end up accessing invalid
memory.  Check for this case and handle it appropriately.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
---
 drivers/infiniband/core/cma.c |   19 +++++++++++--------
 1 files changed, 11 insertions(+), 8 deletions(-)

Comments

Hefty, Sean Aug. 1, 2013, 5:46 a.m. UTC | #1 
> If a application is using AF_IB with a UD QP, but does not
> provide any private data, we will end up accessing invalid
> memory.  Check for this case and handle it appropriately.
> 
> Signed-off-by: Sean Hefty <sean.hefty@intel.com>

Roland, hold off on this patch, but please push the other 2 for 3-11.

After looking at this patch again, it doesn't end up doing much more than introducing a stack variable as an alias for the private data.  The problem I was trying to fix (conn_param->private_data_len too small) shouldn't result in a crash.

- Sean

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 84487a2..4314655 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2676,29 +2676,32 @@  static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
 {
 	struct ib_cm_sidr_req_param req;
 	struct ib_cm_id	*id;
+	void *private_data;
 	int offset, ret;
 
+	memset(&req, 0, sizeof req);
 	offset = cma_user_data_offset(id_priv);
 	req.private_data_len = offset + conn_param->private_data_len;
 	if (req.private_data_len < conn_param->private_data_len)
 		return -EINVAL;
 
 	if (req.private_data_len) {
-		req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
-		if (!req.private_data)
+		private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
+		if (!private_data)
 			return -ENOMEM;
 	} else {
-		req.private_data = NULL;
+		private_data = NULL;
 	}
 
 	if (conn_param->private_data && conn_param->private_data_len)
-		memcpy((void *) req.private_data + offset,
-		       conn_param->private_data, conn_param->private_data_len);
+		memcpy(private_data + offset, conn_param->private_data,
+		       conn_param->private_data_len);
 
-	if (req.private_data) {
-		ret = cma_format_hdr((void *) req.private_data, id_priv);
+	if (private_data) {
+		ret = cma_format_hdr(private_data, id_priv);
 		if (ret)
 			goto out;
+		req.private_data = private_data;
 	}
 
 	id = ib_create_cm_id(id_priv->id.device, cma_sidr_rep_handler,
@@ -2720,7 +2723,7 @@  static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
 		id_priv->cm_id.ib = NULL;
 	}
 out:
-	kfree(req.private_data);
+	kfree(private_data);
 	return ret;
 }