Unverified Commit 0586491f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15024 net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Z6MVPATTAN72NNBLQOFVJGFR5YQ7OACD/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBJC74 
 
Link:https://gitee.com/openeuler/kernel/pulls/15024

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 423fd697 f7c0e5d4

net/smc/af_smc.c

+5 −1
Original line number Diff line number Diff line
@@ -1761,6 +1761,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc, 
	if (pclc->hdr.typev1 == SMC_TYPE_N)

		return 0;

	pclc_prfx = smc_clc_proposal_get_prefix(pclc);

	if (!pclc_prfx)

		return -EPROTO;

	if (smc_clc_prfx_match(newclcsock, pclc_prfx))

		return SMC_CLC_DECL_DIFFPREFIX;
@@ -1917,7 +1919,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc, 
	struct smc_clc_msg_smcd *pclc_smcd = smc_get_clc_msg_smcd(pclc);



	/* check if ISM V1 is available */

	if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1))

	if (!(ini->smcd_version & SMC_V1) ||

	    !smcd_indicated(ini->smc_type_v1) ||

	    !pclc_smcd)

		goto not_found;

	ini->is_smcd = true; /* prepare ISM check */

	ini->ism_peer_gid[0] = ntohll(pclc_smcd->ism.gid);

net/smc/smc_clc.c

+4 −0
Original line number Diff line number Diff line
@@ -49,6 +49,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) 


	v2_ext = smc_get_clc_v2_ext(pclc);

	pclc_prfx = smc_clc_proposal_get_prefix(pclc);

	if (!pclc_prfx ||

	    pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)

		return false;



	if (hdr->version == SMC_V1) {

		if (hdr->typev1 == SMC_TYPE_N)

			return false;

net/smc/smc_clc.h

+5 −1
Original line number Diff line number Diff line
@@ -259,8 +259,12 @@ struct smc_clc_msg_decline { /* clc decline message */ 
static inline struct smc_clc_msg_proposal_prefix *

smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc)

{

	u16 offset = ntohs(pclc->iparea_offset);



	if (offset > sizeof(struct smc_clc_msg_smcd))

		return NULL;

	return (struct smc_clc_msg_proposal_prefix *)

	       ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset));

	       ((u8 *)pclc + sizeof(*pclc) + offset);

}



static inline bool smcr_indicated(int smc_type)