Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f45ee80e authored by Hefty, Sean's avatar Hefty, Sean Committed by Roland Dreier
Browse files

RDMA/cma: Check for NULL conn_param in rdma_accept 



Check that conn_param is not null before dereferencing it when
processing rdma_accept().  This is necessary to prevent a possible
system crash, which can be caused by user space.

Problem found by code inspection.

Signed-off-by: default avatarSean Hefty <sean.hefty@intel.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 10889a36

drivers/infiniband/core/cma.c

+23 −15
Original line number Diff line number Diff line
@@ -2616,14 +2616,16 @@ static int cma_connect_iw(struct rdma_id_private *id_priv, 
	if (ret)

		goto out;



	if (conn_param) {

		iw_param.ord = conn_param->initiator_depth;

		iw_param.ird = conn_param->responder_resources;

		iw_param.private_data = conn_param->private_data;

		iw_param.private_data_len = conn_param->private_data_len;

	if (id_priv->id.qp)

		iw_param.qpn = id_priv->id.qp ? id_priv->qp_num : conn_param->qp_num;

	} else {

		memset(&iw_param, 0, sizeof iw_param);

		iw_param.qpn = id_priv->qp_num;

	else

		iw_param.qpn = conn_param->qp_num;

	}

	ret = iw_cm_connect(cm_id, &iw_param);

out:

	if (ret) {
@@ -2765,14 +2767,20 @@ int rdma_accept(struct rdma_cm_id *id, struct rdma_conn_param *conn_param) 


	switch (rdma_node_get_transport(id->device->node_type)) {

	case RDMA_TRANSPORT_IB:

		if (id->qp_type == IB_QPT_UD)

		if (id->qp_type == IB_QPT_UD) {

			if (conn_param)

				ret = cma_send_sidr_rep(id_priv, IB_SIDR_SUCCESS,

							conn_param->private_data,

							conn_param->private_data_len);

		else if (conn_param)

			else

				ret = cma_send_sidr_rep(id_priv, IB_SIDR_SUCCESS,

							NULL, 0);

		} else {

			if (conn_param)

				ret = cma_accept_ib(id_priv, conn_param);

			else

				ret = cma_rep_recv(id_priv);

		}

		break;

	case RDMA_TRANSPORT_IWARP:

		ret = cma_accept_iw(id_priv, conn_param);