Commit b7ab0b19 authored Oct 06, 2011 by Hefty, Sean Committed by Roland Dreier Oct 06, 2011

IB/mad: Verify mgmt class in received MADs



If a received MAD contains an invalid or reserved mgmt class, we will
attempt to access method_table outside of its range.  Add a check to
ensure that mgmt class falls within the handled range.

Found by code inspection.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

parent f45ee80e

drivers/infiniband/core/mad.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1596,6 +1596,9 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
		mad->mad_hdr.class_version].class;
		if (!class)
		goto out;
		if (convert_mgmt_class(mad->mad_hdr.mgmt_class) >=
		IB_MGMT_MAX_METHODS)
		goto out;
		method = class->method_table[convert_mgmt_class(
		mad->mad_hdr.mgmt_class)];
		if (method)