RDMA/addr: Be strict with gid size
PATCH 1/1 RDMA/addr: Be strict with gid size
From: Leon Romanovsky <[email protected]>
The nla_len() is less than or equal to 16. If it's less than 16 then end of the "gid" buffer is uninitialized.
Fixes ae43f8286730 ("IB/core: Add IP to GID netlink offload")
Reported-by Dan Carpenter <[email protected]>
Signed-off-by Mark Bloch <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- drivers/infiniband/core/addr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/core/addr.c +3 -1
@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq;static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX ] = { [LS_NLA_TYPE_DGID ] = {.type =NLA_BINARY , - .len =sizeof (struct rdma_nla_ls_gid )}, + .len =sizeof (struct rdma_nla_ls_gid ), + .validation_type =NLA_VALIDATE_MIN , + .min =sizeof (struct rdma_nla_ls_gid )}, };static inline bool ib_nl_is_good_ip_resp (const struct nlmsghdr *nlh)
Signature · 1 line
2.30.2
Quoted 5 lines · Leon Romanovsky
From: Leon Romanovsky <[email protected]>
The
nla_len()is less than or equal to 16. If it's less than 16 then end of the "gid" buffer is uninitialized.
Quoted 7 lines
Fixes ae43f8286730 ("IB/core: Add IP to GID netlink offload")Reported-by Dan Carpenter <[email protected]>Signed-off-by Mark Bloch <[email protected]>Signed-off-by Leon Romanovsky <[email protected]>--- drivers/infiniband/core/addr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Applied to for-rc, thanks
Jason