]> www.infradead.org Git - users/jedix/linux-maple.git/commit
IB/core: Fix a potential array overrun in CMA and SA agent
authorYuval Shaia <yuval.shaia@oracle.com>
Thu, 11 May 2017 01:03:18 +0000 (21:03 -0400)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 1 Jun 2017 06:15:46 +0000 (23:15 -0700)
commitf9132941c4e456dc14fe5b4c0004958bd2cd9b75
treebe94e6298dda06bdc1651f6e36db2be425f719ff
parent2ec378d9609dc8fab343e9ddfa8a6ad0b0c464ca
IB/core: Fix a potential array overrun in CMA and SA agent

Orabug: 26124118

Fix array overrun when going over callback table.
In declaration of callback table, the max size isn't provided and in
registration phase, it is provided.

There is potential scenario where a new operation is added and it is not
supported by current client. The acceptance of such operation by ib_netlink
will cause to array overrun.

Fixes: 809d5fc9bf65 ("infiniband: pass rdma_cm module to
netlink_dump_start")
Fixes: b493d91d333e ("iwcm: common code for port mapper")
Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
(Backported from commit 2fa2d4fb1166d1ef35f0aacac6165d53ab1b89c7)

Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Shamir Rabinovitch <shamir.rabinovitch@oracle.com>
drivers/infiniband/core/cma.c
drivers/infiniband/core/sa_query.c