Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d53ec8af authored by Steve Wise's avatar Steve Wise Committed by Jason Gunthorpe
Browse files

RDMA/iwcm: Don't copy past the end of dev_name() string 



We now use dev_name(&ib_device->dev) instead of ib_device->name in iwpm
messages.  The name field in struct device is a const char *, where as
ib_device->name is a char array of size IB_DEVICE_NAME_MAX, and it is
pre-initialized to zeros.

Since iw_cm_map() was using memcpy() to copy in the device name, and
copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the end of the
source device name string and copying random bytes.  This results in iwpmd
failing the REGISTER_PID request from iwcm.  Thus port mapping is broken.

Validate the device and if names, and use strncpy() to inialize the entire
message field.

Fixes: 896de009 ("RDMA/core: Use dev_name instead of ibdev->name")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent bb7e22a8

drivers/infiniband/core/iwcm.c

+8 −4
Original line number Original line Diff line number Diff line
@@ -502,17 +502,21 @@ static void iw_cm_check_wildcard(struct sockaddr_storage *pm_addr, 
 */

 */

static int iw_cm_map(struct iw_cm_id *cm_id, bool active)

static int iw_cm_map(struct iw_cm_id *cm_id, bool active)

{

{

	const char *devname = dev_name(&cm_id->device->dev);

	const char *ifname = cm_id->device->iwcm->ifname;

	struct iwpm_dev_data pm_reg_msg;

	struct iwpm_dev_data pm_reg_msg;

	struct iwpm_sa_data pm_msg;

	struct iwpm_sa_data pm_msg;

	int status;

	int status;





	if (strlen(devname) >= sizeof(pm_reg_msg.dev_name) ||

	    strlen(ifname) >= sizeof(pm_reg_msg.if_name))

		return -EINVAL;



	cm_id->m_local_addr = cm_id->local_addr;

	cm_id->m_local_addr = cm_id->local_addr;

	cm_id->m_remote_addr = cm_id->remote_addr;

	cm_id->m_remote_addr = cm_id->remote_addr;





	memcpy(pm_reg_msg.dev_name, dev_name(&cm_id->device->dev),

	strncpy(pm_reg_msg.dev_name, devname, sizeof(pm_reg_msg.dev_name));

	       sizeof(pm_reg_msg.dev_name));

	strncpy(pm_reg_msg.if_name, ifname, sizeof(pm_reg_msg.if_name));

	memcpy(pm_reg_msg.if_name, cm_id->device->iwcm->ifname,

	       sizeof(pm_reg_msg.if_name));





	if (iwpm_register_pid(&pm_reg_msg, RDMA_NL_IWCM) ||

	if (iwpm_register_pid(&pm_reg_msg, RDMA_NL_IWCM) ||

	    !iwpm_valid_pid())

	    !iwpm_valid_pid())