From patchwork Thu Dec 20 19:37:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Wise X-Patchwork-Id: 10739597 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0912A14E5 for ; Thu, 20 Dec 2018 20:48:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EC41928D27 for ; Thu, 20 Dec 2018 20:48:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D7E7D28D0A; Thu, 20 Dec 2018 20:48:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7952A28D37 for ; Thu, 20 Dec 2018 20:48:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387603AbeLTUsK (ORCPT ); Thu, 20 Dec 2018 15:48:10 -0500 Received: from opengridcomputing.com ([72.48.214.68]:40912 "EHLO smtp.opengridcomputing.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733134AbeLTUsJ (ORCPT ); Thu, 20 Dec 2018 15:48:09 -0500 Received: by smtp.opengridcomputing.com (Postfix, from userid 503) id 5B78E22783; Thu, 20 Dec 2018 14:48:09 -0600 (CST) From: Steve Wise Date: Thu, 20 Dec 2018 11:37:54 -0800 Subject: [PATCH rdma-rc] RDMA/iwcm: Don't copy past the end of dev_name() string To: dledford@redhat.com, jgg@mellanox.com Cc: linux-rdma@vger.kernel.org, chien.tin.tung@intel.com, shiraz.saleem@intel.com Message-Id: <20181220204809.5B78E22783@smtp.opengridcomputing.com> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We now use dev_name(&ib_device->dev) instead of ib_device->name in iwpm messages. The name field in struct device is a const char *, where as ib_device->name is a char array of size IB_DEVICE_NAME_MAX, and it is pre-initialized to zeros. Since iw_cm_map() was using memcpy() to copy in the device name, and copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the device name string and getting random bytes. This results in iwpmd failing the REGISTER_PID request from iwcm. Thus port mapping is broken. The fix is to initialize the iwpm_dev_data message memory to zeros, and then strcopy() to avoid copying past the end of the dev_name() string. Fixes: 896de0090a85 ("RDMA/core: Use dev_name instead of ibdev->name") Signed-off-by: Steve Wise --- drivers/infiniband/core/iwcm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index ba668d49c751..c8f300d1b4fc 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -502,16 +502,16 @@ static void iw_cm_check_wildcard(struct sockaddr_storage *pm_addr, */ static int iw_cm_map(struct iw_cm_id *cm_id, bool active) { - struct iwpm_dev_data pm_reg_msg; + struct iwpm_dev_data pm_reg_msg = {}; struct iwpm_sa_data pm_msg; int status; cm_id->m_local_addr = cm_id->local_addr; cm_id->m_remote_addr = cm_id->remote_addr; - memcpy(pm_reg_msg.dev_name, dev_name(&cm_id->device->dev), + strncpy(pm_reg_msg.dev_name, dev_name(&cm_id->device->dev), sizeof(pm_reg_msg.dev_name)); - memcpy(pm_reg_msg.if_name, cm_id->device->iwcm->ifname, + strncpy(pm_reg_msg.if_name, cm_id->device->iwcm->ifname, sizeof(pm_reg_msg.if_name)); if (iwpm_register_pid(&pm_reg_msg, RDMA_NL_IWCM) ||