Re: [PATCH] RDMA/netlink: OOPs in rdma_nl_rcv_msg() from misinterpreted flag

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Oct 24, 2017 at 08:41:01AM -0400, Michael J. Ruhl wrote:
> From: Michael J. Ruhl <michael.j.ruhl@xxxxxxxxx>
> 
> ---
>  drivers/infiniband/core/netlink.c |   13 ++++++++++++-
>  1 files changed, 12 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
> index b12e587..1fb72c3 100644
> --- a/drivers/infiniband/core/netlink.c
> +++ b/drivers/infiniband/core/netlink.c
> @@ -175,13 +175,24 @@ static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
>  	    !netlink_capable(skb, CAP_NET_ADMIN))
>  		return -EPERM;
>  
> +	/*
> +	 * LS responses overload the 0x100 (NLM_F_ROOT) flag.  Don't
> +	 * mistakenly call the .dump() function.
> +	 */
> +	if (index == RDMA_NL_LS) {
> +		if (cb_table[op].doit)
> +			return cb_table[op].doit(skb, nlh, extack);
> +		return -EINVAL;
> +	}
>  	/* FIXME: Convert IWCM to properly handle doit callbacks */
>  	if ((nlh->nlmsg_flags & NLM_F_DUMP) || index == RDMA_NL_RDMA_CM ||
>  	    index == RDMA_NL_IWCM) {
>  		struct netlink_dump_control c = {
>  			.dump = cb_table[op].dump,
>  		};
> -		return netlink_dump_start(nls, skb, nlh, &c);
> +		if (c.dump)
> +			return netlink_dump_start(nls, skb, nlh, &c);
> +		return -EINVAL;
>  	}
>  
>  	if (cb_table[op].doit)
>

Do you neccessarily need the non-null checks for cb_table[op].doit and c.dump?

Otherwise, looks good.

Reviewed-by: Shiraz Saleem <shiraz.saleem@xxxxxxxxx> 
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux