Unverified Commit f8c09dd6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14988 net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zeng Heng <zengheng4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/IHQ6ZCCXZFFHAUWOJ4I5ZPADK4REJZAX/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBJCCV 
 
Link:https://gitee.com/openeuler/kernel/pulls/14988

 

Reviewed-by: default avatarWang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 923dfb22 18172f07

net/smc/af_smc.c

+2 −1
Original line number Diff line number Diff line
@@ -2280,7 +2280,8 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, 
		goto not_found;



	smc_v2_ext = smc_get_clc_v2_ext(pclc);

	if (!smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))

	if (!smc_v2_ext ||

	    !smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL))

		goto not_found;



	/* prepare RDMA check */

net/smc/smc_clc.c

+7 −1
Original line number Diff line number Diff line
@@ -352,7 +352,6 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) 
	struct smc_clc_msg_hdr *hdr = &pclc->hdr;

	struct smc_clc_v2_extension *v2_ext;



	v2_ext = smc_get_clc_v2_ext(pclc);

	pclc_prfx = smc_clc_proposal_get_prefix(pclc);

	if (hdr->version == SMC_V1) {

		if (hdr->typev1 == SMC_TYPE_N)
@@ -365,6 +364,13 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) 
			sizeof(struct smc_clc_msg_trail))

			return false;

	} else {

		v2_ext = smc_get_clc_v2_ext(pclc);

		if ((hdr->typev2 != SMC_TYPE_N &&

		     (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) ||

		    (smcd_indicated(hdr->typev2) &&

		     v2_ext->hdr.ism_gid_cnt > SMCD_CLC_MAX_V2_GID_ENTRIES))

			return false;



		if (ntohs(hdr->length) !=

			sizeof(*pclc) +

			sizeof(struct smc_clc_msg_smcd) +

net/smc/smc_clc.h

+7 −1
Original line number Diff line number Diff line
@@ -366,8 +366,14 @@ static inline struct smc_clc_v2_extension * 
smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)

{

	struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop);

	u16 max_offset;



	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset))

	max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -

		     offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) -

		     offsetofend(struct smc_clc_msg_smcd, v2_ext_offset);



	if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) ||

	    ntohs(prop_smcd->v2_ext_offset) > max_offset)

		return NULL;



	return (struct smc_clc_v2_extension *)