diff mbox

[RESEND,1/1] rdma_cm: fail iwarp accepts w/o connection params

Message ID 20170221194805.03181E0BEF@smtp.ogc.us (mailing list archive)
State Accepted
Headers show

Commit Message

Steve Wise Feb. 21, 2017, 7:21 p.m. UTC 
cma_accept_iw() needs to return an error if conn_params is NULL.
Since this is coming from user space, we can crash.

Reported-by: Shaobo He <shaobo@cs.utah.edu>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Cc: stable@vger.kernel.org
---

(resent because I screwed up linux-rdma mailing address)

---

 drivers/infiniband/core/cma.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Doug Ledford Feb. 22, 2017, 8:36 p.m. UTC | #1 
On Tue, 2017-02-21 at 11:21 -0800, Steve Wise wrote:
> cma_accept_iw() needs to return an error if conn_params is NULL.
> Since this is coming from user space, we can crash.
> 
> Reported-by: Shaobo He <shaobo@cs.utah.edu>
> Acked-by: Sean Hefty <sean.hefty@intel.com>
> Signed-off-by: Steve Wise <swise@opengridcomputing.com>
> Cc: stable@vger.kernel.org

Thanks, applied.
diff mbox

Patch

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 3e70a9c..c377afc 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3583,6 +3583,9 @@  static int cma_accept_iw(struct rdma_id_private *id_priv,
 	struct iw_cm_conn_param iw_param;
 	int ret;
 
+	if (!conn_param)
+		return -EINVAL;
+
 	ret = cma_modify_qp_rtr(id_priv, conn_param);
 	if (ret)
 		return ret;