ibacm: Fix invalid memory dereference in acm_process_join_resp
PATCH 1/1 ibacm: Fix invalid memory dereference in acm_process_join_resp
From: Sean Hefty <[email protected]>
If a join request fails, the dest pointer may not be initialized. This can result in the ibacm daemon crashing. Fix the crash and ensure that the multicast state is set correctly in case the join fails by initializing the state to ACM_INIT before sending the join request.
Problem reported by: Kaike Wan <[email protected]>
Signed-off-by Sean Hefty <[email protected]>
--- src/acm.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
src/acm.c +1 -1
@@ -801,7 +801,6 @@ err2:ibv_destroy_ah (dest->ah); dest->ah =NULL ; err1: - dest->state =ACM_INIT ;lock_release (&ep->lock); }
@@ -1568,6 +1567,7 @@ static void acm_join_group(struct acm_ep *ep, union ibv_gid *port_gid,acm_log (0 ,"%s %d pkey 0x%x, sl 0x%x, rate 0x%x, mtu 0x%x\n" , ep->port->dev->verbs->device->name, ep->port->port_num, ep->pkey, sl, rate, mtu); + ep->mc_dest[ep->mc_cnt].state =ACM_INIT ; mad = (struct ib_sa_mad *) umad->data;acm_init_join (mad, port_gid, ep->pkey, tos, tclass, sl, rate, mtu); mc_rec = (struct ib_mc_member_rec *) mad->data;
Signature · 6 lines
1.7.3 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html