From patchwork Sun Apr 13 21:47:38 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hefty, Sean" X-Patchwork-Id: 3975341 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D269C9F2BA for ; Sun, 13 Apr 2014 21:47:57 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id DF931201FB for ; Sun, 13 Apr 2014 21:47:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 78BEC201F2 for ; Sun, 13 Apr 2014 21:47:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750779AbaDMVrx (ORCPT ); Sun, 13 Apr 2014 17:47:53 -0400 Received: from mga02.intel.com ([134.134.136.20]:7605 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750770AbaDMVrw (ORCPT ); Sun, 13 Apr 2014 17:47:52 -0400 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 13 Apr 2014 14:47:52 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.97,853,1389772800"; d="scan'208";a="492283194" Received: from cst-linux.jf.intel.com ([10.23.221.72]) by orsmga001.jf.intel.com with ESMTP; 13 Apr 2014 14:47:51 -0700 From: sean.hefty@intel.com To: linux-rdma@vger.kernel.org, sean.hefty@intel.com, ira.weiny@intel.com, kaike.wan@intel.com, john.fleck@intel.com Subject: [PATCH] ibacm: Fix invalid memory dereference in acm_process_join_resp Date: Sun, 13 Apr 2014 14:47:38 -0700 Message-Id: <1397425658-30876-1-git-send-email-sean.hefty@intel.com> X-Mailer: git-send-email 1.7.3 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Sean Hefty If a join request fails, the dest pointer may not be initialized. This can result in the ibacm daemon crashing. Fix the crash and ensure that the multicast state is set correctly in case the join fails by initializing the state to ACM_INIT before sending the join request. Problem reported by: Kaike Wan Signed-off-by: Sean Hefty --- src/acm.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/acm.c b/src/acm.c index 851a258..fcbe313 100644 --- a/src/acm.c +++ b/src/acm.c @@ -801,7 +801,6 @@ err2: ibv_destroy_ah(dest->ah); dest->ah = NULL; err1: - dest->state = ACM_INIT; lock_release(&ep->lock); } @@ -1568,6 +1567,7 @@ static void acm_join_group(struct acm_ep *ep, union ibv_gid *port_gid, acm_log(0, "%s %d pkey 0x%x, sl 0x%x, rate 0x%x, mtu 0x%x\n", ep->port->dev->verbs->device->name, ep->port->port_num, ep->pkey, sl, rate, mtu); + ep->mc_dest[ep->mc_cnt].state = ACM_INIT; mad = (struct ib_sa_mad *) umad->data; acm_init_join(mad, port_gid, ep->pkey, tos, tclass, sl, rate, mtu); mc_rec = (struct ib_mc_member_rec *) mad->data;