Commit d1c803a9 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Jason Gunthorpe
Browse files

RDMA/addr: Be strict with gid size 

The nla_len() is less than or equal to 16.  If it's less than 16 then end
of the "gid" buffer is uninitialized.

Fixes: ae43f828 ("IB/core: Add IP to GID netlink offload")
Link: https://lore.kernel.org/r/20210405074434.264221-1-leon@kernel.org


Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMark Bloch <mbloch@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent e1ad897b

drivers/infiniband/core/addr.c

+3 −1
Original line number Diff line number Diff line
@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq; 


static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {

	[LS_NLA_TYPE_DGID] = {.type = NLA_BINARY,

		.len = sizeof(struct rdma_nla_ls_gid)},

		.len = sizeof(struct rdma_nla_ls_gid),

		.validation_type = NLA_VALIDATE_MIN,

		.min = sizeof(struct rdma_nla_ls_gid)},

};



static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)