Unverified Commit 7889f043 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15037 net/smc: check smcd_v2_ext_offset when receiving proposal msg 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FHLPAL53AOBPZNSNOQE6ADTGG4I5HJFO/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBJC6V 
 
Link:https://gitee.com/openeuler/kernel/pulls/15037

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents d67cd7a0 ddaf826e

net/smc/af_smc.c

+2 −0
Original line number Diff line number Diff line
@@ -2155,6 +2155,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc, 
	pclc_smcd = smc_get_clc_msg_smcd(pclc);

	smc_v2_ext = smc_get_clc_v2_ext(pclc);

	smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext);

	if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext)

		goto not_found;



	mutex_lock(&smcd_dev_list.mutex);

	if (pclc_smcd->ism.chid) {

net/smc/smc_clc.h

+7 −1
Original line number Diff line number Diff line
@@ -390,9 +390,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) 
static inline struct smc_clc_smcd_v2_extension *

smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)

{

	u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -

		offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -

		offsetof(struct smc_clc_v2_extension, hdr) -

		offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);



	if (!prop_v2ext)

		return NULL;

	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))

	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) ||

	    ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)

		return NULL;



	return (struct smc_clc_smcd_v2_extension *)