Commit 32cd6e7d authored by Md Haris Iqbal's avatar Md Haris Iqbal Committed by Liu Jian
Browse files

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds 

mainline inclusion
from mainline-v6.12-rc1
commit 3e4289b29e216a55d08a89e126bc0b37cbad9f38
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK0
CVE: CVE-2024-47695

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e4289b29e216a55d08a89e126bc0b37cbad9f38



-------------------------------------------------

In the function init_conns(), after the create_con() and create_cm() for
loop if something fails. In the cleanup for loop after the destroy tag, we
access out of bound memory because cid is set to clt_path->s.con_num.

This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds
in the cleanup loop later.

Fixes: 6a98d71d ("RDMA/rtrs: client: main functionality")
Signed-off-by: default avatarMd Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: default avatarJack Wang <jinpu.wang@ionos.com>
Signed-off-by: default avatarGrzegorz Prajsner <grzegorz.prajsner@ionos.com>
Link: https://patch.msgid.link/20240821112217.41827-7-haris.iqbal@ionos.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>

Conflicts:
	drivers/infiniband/ulp/rtrs/rtrs-clt.c
[Did not backport 9c29c8c7, caa84d95.]
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 2f1dfb23

drivers/infiniband/ulp/rtrs/rtrs-clt.c

+6 −0
Original line number Diff line number Diff line
@@ -2231,6 +2231,12 @@ static int init_conns(struct rtrs_clt_sess *sess) 
			goto destroy;

		}

	}



	/*

	 * Set the cid to con_num - 1, since if we fail later, we want to stay in bounds.

	 */

	cid = sess->s.con_num - 1;



	err = alloc_sess_reqs(sess);

	if (err)

		goto destroy;