Unverified Commit b3243fe9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15025 net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QHSQMOGSDGDFPTQ2OLWEI2BOIEDL62YD/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBJC74 
 
Link:https://gitee.com/openeuler/kernel/pulls/15025

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents be69fb5f f0577db8

net/smc/af_smc.c

+5 −1
Original line number Diff line number Diff line
@@ -2040,6 +2040,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc, 
	if (pclc->hdr.typev1 == SMC_TYPE_N)

		return 0;

	pclc_prfx = smc_clc_proposal_get_prefix(pclc);

	if (!pclc_prfx)

		return -EPROTO;

	if (smc_clc_prfx_match(newclcsock, pclc_prfx))

		return SMC_CLC_DECL_DIFFPREFIX;
@@ -2229,7 +2231,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc, 
	int rc = 0;



	/* check if ISM V1 is available */

	if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1))

	if (!(ini->smcd_version & SMC_V1) ||

	    !smcd_indicated(ini->smc_type_v1) ||

	    !pclc_smcd)

		goto not_found;

	ini->is_smcd = true; /* prepare ISM check */

	ini->ism_peer_gid[0].gid = ntohll(pclc_smcd->ism.gid);

net/smc/smc_clc.c

+4 −0
Original line number Diff line number Diff line
@@ -353,6 +353,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) 
	struct smc_clc_v2_extension *v2_ext;



	pclc_prfx = smc_clc_proposal_get_prefix(pclc);

	if (!pclc_prfx ||

	    pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX)

		return false;



	if (hdr->version == SMC_V1) {

		if (hdr->typev1 == SMC_TYPE_N)

			return false;

net/smc/smc_clc.h

+5 −1
Original line number Diff line number Diff line
@@ -326,8 +326,12 @@ struct smc_clc_msg_decline_v2 { /* clc decline message */ 
static inline struct smc_clc_msg_proposal_prefix *

smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc)

{

	u16 offset = ntohs(pclc->iparea_offset);



	if (offset > sizeof(struct smc_clc_msg_smcd))

		return NULL;

	return (struct smc_clc_msg_proposal_prefix *)

	       ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset));

	       ((u8 *)pclc + sizeof(*pclc) + offset);

}



static inline bool smcr_indicated(int smc_type)