| Message ID | 20181220223939.B1E7F22783@smtp.opengridcomputing.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d53ec8af56d5163f8a42e961ece3aeb5c560e79d |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [v2,rdma-next] RDMA/iwcm: Don't copy past the end of dev_name() string | expand |
On Thu, Dec 20, 2018 at 02:00:11PM -0800, Steve Wise wrote: > We now use dev_name(&ib_device->dev) instead of ib_device->name in > iwpm messages. The name field in struct device is a const char *, > where as ib_device->name is a char array of size IB_DEVICE_NAME_MAX, > and it is pre-initialized to zeros. > > Since iw_cm_map() was using memcpy() to copy in the device name, and > copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the end of the > source device name string and copying random bytes. This results in iwpmd > failing the REGISTER_PID request from iwcm. Thus port mapping is broken. > > Validate the device and if names, and use strncpy() to inialize the > entire message field. > > Fixes: 896de0090a85 ("RDMA/core: Use dev_name instead of ibdev->name") > Cc: stable@vger.kernel.org > Signed-off-by: Steve Wise <swise@opengridcomputing.com> > --- > > Changes since v1: > - rebased onto rdma/for-next > - no need to initialize the iwpm_dev_data struct at declaration; strncpy() > pads out zeros for the length of the dst buffer. > - validate devname and ifname string lengths > > --- > > drivers/infiniband/core/iwcm.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) Applied to for-next Thanks Jason
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index ba668d49c751..476abc74178e 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -502,17 +502,21 @@ static void iw_cm_check_wildcard(struct sockaddr_storage *pm_addr, */ static int iw_cm_map(struct iw_cm_id *cm_id, bool active) { + const char *devname = dev_name(&cm_id->device->dev); + const char *ifname = cm_id->device->iwcm->ifname; struct iwpm_dev_data pm_reg_msg; struct iwpm_sa_data pm_msg; int status; + if (strlen(devname) >= sizeof(pm_reg_msg.dev_name) || + strlen(ifname) >= sizeof(pm_reg_msg.if_name)) + return -EINVAL; + cm_id->m_local_addr = cm_id->local_addr; cm_id->m_remote_addr = cm_id->remote_addr; - memcpy(pm_reg_msg.dev_name, dev_name(&cm_id->device->dev), - sizeof(pm_reg_msg.dev_name)); - memcpy(pm_reg_msg.if_name, cm_id->device->iwcm->ifname, - sizeof(pm_reg_msg.if_name)); + strncpy(pm_reg_msg.dev_name, devname, sizeof(pm_reg_msg.dev_name)); + strncpy(pm_reg_msg.if_name, ifname, sizeof(pm_reg_msg.if_name)); if (iwpm_register_pid(&pm_reg_msg, RDMA_NL_IWCM) || !iwpm_valid_pid())
We now use dev_name(&ib_device->dev) instead of ib_device->name in iwpm messages. The name field in struct device is a const char *, where as ib_device->name is a char array of size IB_DEVICE_NAME_MAX, and it is pre-initialized to zeros. Since iw_cm_map() was using memcpy() to copy in the device name, and copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the end of the source device name string and copying random bytes. This results in iwpmd failing the REGISTER_PID request from iwcm. Thus port mapping is broken. Validate the device and if names, and use strncpy() to inialize the entire message field. Fixes: 896de0090a85 ("RDMA/core: Use dev_name instead of ibdev->name") Cc: stable@vger.kernel.org Signed-off-by: Steve Wise <swise@opengridcomputing.com> --- Changes since v1: - rebased onto rdma/for-next - no need to initialize the iwpm_dev_data struct at declaration; strncpy() pads out zeros for the length of the dst buffer. - validate devname and ifname string lengths --- drivers/infiniband/core/iwcm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)