IB/mad: In validate_mad, validate CM send method for attributes other than ClassPortInfo

Receipt of CM MAD with other than the Send method for an attribute other than the ClassPortInfo attribute is invalid.

CM attributes other than ClassPortInfo only use the send method.

The SRP initiator does not maintain a timeout policy for CM connect requests relies on the CM layer to do that. The result was that the SRP initiator hung as the connect request never completed.

A new SRP target has been observed to respond to Send CM REQ with GetResp of CM REQ with bad status. This is non conformant with IBA spec but exposes a vulnerability in the current MAD/CM code which will respond to the incoming GetResp of CM REQ as if it was a valid incoming Send of CM REQ rather than tossing this on the floor. It also causes the MAD layer not to retransmit the original REQ even though it has not received a REP.

---
Changes since v1:
Removed ClassPortInfo method validation

 drivers/infiniband/core/mad.c |    5 +++++
 include/rdma/ib_mad.h         |    2 ++
 2 files changed, 7 insertions(+), 0 deletions(-)

index 8d8af7a..2281de1 100644
@@ -1811,6 +1811,11 @@ static int validate_mad(const struct ib_mad_hdr *mad_hdr,
 		if (qp_num == 0)
 			valid = 1;
 	} else {
+		/* CM attributes other than ClassPortInfo only use Send method */
+		if ((mad_hdr->mgmt_class == IB_MGMT_CLASS_CM) &&
+		    (mad_hdr->attr_id != IB_MGMT_CLASSPORTINFO_ATTR_ID) &&
+		    (mad_hdr->method != IB_MGMT_METHOD_SEND))
+			goto out;
 		/* Filter GSI packets sent to QP0 */
 		if (qp_num != 0)
 			valid = 1;

index 188df91..ec9b44d 100644
@@ -237,6 +237,8 @@ struct ib_vendor_mad {
 	u8			data[IB_MGMT_VENDOR_DATA];
 };
 
+#define IB_MGMT_CLASSPORTINFO_ATTR_ID	cpu_to_be16(0x0001)
+
 struct ib_class_port_info {
 	u8			base_version;
 	u8			class_version;

1.7.8.2


--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

PiANCj4gDQo+IFJlY2VpcHQgb2YgQ00gTUFEIHdpdGggb3RoZXIgdGhhbiB0aGUgU2VuZCBtZXRo b2QgZm9yIGFuIGF0dHJpYnV0ZSBvdGhlcg0KPiB0aGFuIHRoZSBDbGFzc1BvcnRJbmZvIGF0dHJp YnV0ZSBpcyBpbnZhbGlkLg0KPiANCj4gQ00gYXR0cmlidXRlcyBvdGhlciB0aGFuIENsYXNzUG9y dEluZm8gb25seSB1c2UgdGhlIHNlbmQgbWV0aG9kLg0KPiANCj4gVGhlIFNSUCBpbml0aWF0b3Ig ZG9lcyBub3QgbWFpbnRhaW4gYSB0aW1lb3V0IHBvbGljeSBmb3IgQ00gY29ubmVjdCByZXF1ZXN0 cw0KPiByZWxpZXMgb24gdGhlIENNIGxheWVyIHRvIGRvIHRoYXQuIFRoZSByZXN1bHQgd2FzIHRo YXQgdGhlIFNSUCBpbml0aWF0b3IgaHVuZyBhcw0KPiB0aGUgY29ubmVjdCByZXF1ZXN0IG5ldmVy IGNvbXBsZXRlZC4NCj4gDQo+IEEgbmV3IFNSUCB0YXJnZXQgaGFzIGJlZW4gb2JzZXJ2ZWQgdG8g cmVzcG9uZCB0byBTZW5kIENNIFJFUSB3aXRoIEdldFJlc3ANCj4gb2YgQ00gUkVRIHdpdGggYmFk IHN0YXR1cy4gVGhpcyBpcyBub24gY29uZm9ybWFudCB3aXRoIElCQSBzcGVjIGJ1dCBleHBvc2Vz IGENCj4gdnVsbmVyYWJpbGl0eSBpbiB0aGUgY3VycmVudCBNQUQvQ00gY29kZSB3aGljaCB3aWxs IHJlc3BvbmQgdG8gdGhlIGluY29taW5nDQo+IEdldFJlc3Agb2YgQ00gUkVRIGFzIGlmIGl0IHdh cyBhIHZhbGlkIGluY29taW5nIFNlbmQgb2YgQ00gUkVRIHJhdGhlciB0aGFuDQo+IHRvc3Npbmcg dGhpcyBvbiB0aGUgZmxvb3IuIEl0IGFsc28gY2F1c2VzIHRoZSBNQUQgbGF5ZXIgbm90IHRvIHJl dHJhbnNtaXQgdGhlDQo+IG9yaWdpbmFsIFJFUSBldmVuIHRob3VnaCBpdCBoYXMgbm90IHJlY2Vp dmVkIGEgUkVQLg0KPiANCj4gUmV2aWV3ZWQtYnk6IFNhZ2kgR3JpbWJlcmcgPHNhZ2lnQG1lbGxh bm94LmNvbT4NCg0KUmV2aWV3ZWQtYnk6IElyYSBXZWlueSA8aXJhLndlaW55QGludGVsLmNvbT4N Cg0KPiBTaWduZWQtb2ZmLWJ5OiBIYWwgUm9zZW5zdG9jayA8aGFsQG1lbGxhbm94LmNvbT4NCj4g LS0tDQo+IENoYW5nZXMgc2luY2UgdjE6DQo+IFJlbW92ZWQgQ2xhc3NQb3J0SW5mbyBtZXRob2Qg dmFsaWRhdGlvbg0KPiANCj4gIGRyaXZlcnMvaW5maW5pYmFuZC9jb3JlL21hZC5jIHwgICAgNSAr KysrKw0KPiAgaW5jbHVkZS9yZG1hL2liX21hZC5oICAgICAgICAgfCAgICAyICsrDQo+ICAyIGZp bGVzIGNoYW5nZWQsIDcgaW5zZXJ0aW9ucygrKSwgMCBkZWxldGlvbnMoLSkNCj4gDQo+IGRpZmYg LS1naXQgYS9kcml2ZXJzL2luZmluaWJhbmQvY29yZS9tYWQuYyBiL2RyaXZlcnMvaW5maW5pYmFu ZC9jb3JlL21hZC5jDQo+IGluZGV4IDhkOGFmN2EuLjIyODFkZTEgMTAwNjQ0DQo+IC0tLSBhL2Ry aXZlcnMvaW5maW5pYmFuZC9jb3JlL21hZC5jDQo+ICsrKyBiL2RyaXZlcnMvaW5maW5pYmFuZC9j b3JlL21hZC5jDQo+IEBAIC0xODExLDYgKzE4MTEsMTEgQEAgc3RhdGljIGludCB2YWxpZGF0ZV9t YWQoY29uc3Qgc3RydWN0IGliX21hZF9oZHINCj4gKm1hZF9oZHIsDQo+ICAJCWlmIChxcF9udW0g PT0gMCkNCj4gIAkJCXZhbGlkID0gMTsNCj4gIAl9IGVsc2Ugew0KPiArCQkvKiBDTSBhdHRyaWJ1 dGVzIG90aGVyIHRoYW4gQ2xhc3NQb3J0SW5mbyBvbmx5IHVzZSBTZW5kDQo+IG1ldGhvZCAqLw0K PiArCQlpZiAoKG1hZF9oZHItPm1nbXRfY2xhc3MgPT0gSUJfTUdNVF9DTEFTU19DTSkgJiYNCj4g KwkJICAgIChtYWRfaGRyLT5hdHRyX2lkICE9IElCX01HTVRfQ0xBU1NQT1JUSU5GT19BVFRSX0lE KQ0KPiAmJg0KPiArCQkgICAgKG1hZF9oZHItPm1ldGhvZCAhPSBJQl9NR01UX01FVEhPRF9TRU5E KSkNCj4gKwkJCWdvdG8gb3V0Ow0KPiAgCQkvKiBGaWx0ZXIgR1NJIHBhY2tldHMgc2VudCB0byBR UDAgKi8NCj4gIAkJaWYgKHFwX251bSAhPSAwKQ0KPiAgCQkJdmFsaWQgPSAxOw0KPiBkaWZmIC0t Z2l0IGEvaW5jbHVkZS9yZG1hL2liX21hZC5oIGIvaW5jbHVkZS9yZG1hL2liX21hZC5oIGluZGV4 DQo+IDE4OGRmOTEuLmVjOWI0NGQgMTAwNjQ0DQo+IC0tLSBhL2luY2x1ZGUvcmRtYS9pYl9tYWQu aA0KPiArKysgYi9pbmNsdWRlL3JkbWEvaWJfbWFkLmgNCj4gQEAgLTIzNyw2ICsyMzcsOCBAQCBz dHJ1Y3QgaWJfdmVuZG9yX21hZCB7DQo+ICAJdTgJCQlkYXRhW0lCX01HTVRfVkVORE9SX0RBVEFd Ow0KPiAgfTsNCj4gDQo+ICsjZGVmaW5lIElCX01HTVRfQ0xBU1NQT1JUSU5GT19BVFRSX0lECWNw dV90b19iZTE2KDB4MDAwMSkNCj4gKw0KPiAgc3RydWN0IGliX2NsYXNzX3BvcnRfaW5mbyB7DQo+ ICAJdTgJCQliYXNlX3ZlcnNpb247DQo+ICAJdTgJCQljbGFzc192ZXJzaW9uOw0KPiAtLQ0KPiAx LjcuOC4yDQo+IA0KDQo=
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html