* [PATCH rdma-next 0/4] Trivial fixes
@ 2016-05-04 5:36 Leon Romanovsky
[not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
0 siblings, 1 reply; 14+ messages in thread
From: Leon Romanovsky @ 2016-05-04 5:36 UTC (permalink / raw)
To: dledford-H+wXaHxf7aLQT0dZR+AlfA
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w,
majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w,
Leon Romanovsky
Hi Doug,
I'm sending to you small collection of trivial fixes to core code.
It fixes forgotten skb release call, potential overrun in CMA. SA and
two code simplifications which doesn't introduce any code change
behavior.
Available in the "topic/fix-core" topic branch of this git repo:
git://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma.git
Or for browsing:
https://git.kernel.org/cgit/linux/kernel/git/leon/linux-rdma.git/log/?h=topic/fix-core
Mark Bloch (4):
IB/iwpm: Fix a potential skb leak
IB/core: Remove unnecessary check in ibnl_rcv_msg
IB/core: Fix a potential array overrun in CMA and SA agent
IB/sa: Use nlmsg_free instead of kfree_skb
drivers/infiniband/core/cma.c | 2 +-
drivers/infiniband/core/iwcm.c | 2 +-
drivers/infiniband/core/iwpm_util.c | 1 +
drivers/infiniband/core/netlink.c | 3 +--
drivers/infiniband/core/sa_query.c | 4 ++--
5 files changed, 6 insertions(+), 6 deletions(-)
--
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 14+ messages in thread[parent not found: <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>]
* [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak [not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> @ 2016-05-04 5:36 ` Leon Romanovsky [not found] ` <1462340165-16067-2-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 5:36 ` [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg Leon Romanovsky ` (3 subsequent siblings) 4 siblings, 1 reply; 14+ messages in thread From: Leon Romanovsky @ 2016-05-04 5:36 UTC (permalink / raw) To: dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w, Leon Romanovsky From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> In case ibnl_put_msg fails in send_nlmsg_done, the function returns with -ENOMEM without freeing. This patch fixes this behavior. Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service") Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> --- drivers/infiniband/core/iwpm_util.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c index 9b2bf2f..b65e06c 100644 --- a/drivers/infiniband/core/iwpm_util.c +++ b/drivers/infiniband/core/iwpm_util.c @@ -634,6 +634,7 @@ static int send_nlmsg_done(struct sk_buff *skb, u8 nl_client, int iwpm_pid) if (!(ibnl_put_msg(skb, &nlh, 0, 0, nl_client, RDMA_NL_IWPM_MAPINFO, NLM_F_MULTI))) { pr_warn("%s Unable to put NLMSG_DONE\n", __func__); + dev_kfree_skb(skb); return -ENOMEM; } nlh->nlmsg_type = NLMSG_DONE; -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 14+ messages in thread
[parent not found: <1462340165-16067-2-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>]
* RE: [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak [not found] ` <1462340165-16067-2-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> @ 2016-05-04 15:36 ` Steve Wise 0 siblings, 0 replies; 14+ messages in thread From: Steve Wise @ 2016-05-04 15:36 UTC (permalink / raw) To: 'Leon Romanovsky', dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w > -----Original Message----- > From: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org [mailto:linux-rdma- > owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org] On Behalf Of Leon Romanovsky > Sent: Wednesday, May 04, 2016 12:36 AM > To: dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org > Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org; markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; majd-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; > matanb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; Leon Romanovsky > Subject: [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak > > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > In case ibnl_put_msg fails in send_nlmsg_done, > the function returns with -ENOMEM without freeing. > > This patch fixes this behavior. > > Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space > service") > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > --- > drivers/infiniband/core/iwpm_util.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/infiniband/core/iwpm_util.c > b/drivers/infiniband/core/iwpm_util.c > index 9b2bf2f..b65e06c 100644 > --- a/drivers/infiniband/core/iwpm_util.c > +++ b/drivers/infiniband/core/iwpm_util.c > @@ -634,6 +634,7 @@ static int send_nlmsg_done(struct sk_buff *skb, u8 > nl_client, int iwpm_pid) > if (!(ibnl_put_msg(skb, &nlh, 0, 0, nl_client, > RDMA_NL_IWPM_MAPINFO, NLM_F_MULTI))) { > pr_warn("%s Unable to put NLMSG_DONE\n", __func__); > + dev_kfree_skb(skb); > return -ENOMEM; > } > nlh->nlmsg_type = NLMSG_DONE; > -- > 2.1.4 Looks good. Reviewed-by: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org> -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg [not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 5:36 ` [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak Leon Romanovsky @ 2016-05-04 5:36 ` Leon Romanovsky [not found] ` <1462340165-16067-3-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 5:36 ` [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent Leon Romanovsky ` (2 subsequent siblings) 4 siblings, 1 reply; 14+ messages in thread From: Leon Romanovsky @ 2016-05-04 5:36 UTC (permalink / raw) To: dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w, Leon Romanovsky From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> RDMA_NL_GET_OP is defined like this: (type & ((1 << 10) - 1)) which means op (defined as an int) can never be a negative number. Fixes: b2cbae2c2487 ('RDMA: Add netlink infrastructure') Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> --- drivers/infiniband/core/netlink.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c index d47df93..aa491f7 100644 --- a/drivers/infiniband/core/netlink.c +++ b/drivers/infiniband/core/netlink.c @@ -155,8 +155,7 @@ static int ibnl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) list_for_each_entry(client, &client_list, list) { if (client->index == index) { - if (op < 0 || op >= client->nops || - !client->cb_table[op].dump) + if (op >= client->nops || !client->cb_table[op].dump) return -EINVAL; /* -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 14+ messages in thread
[parent not found: <1462340165-16067-3-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>]
* RE: [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg [not found] ` <1462340165-16067-3-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> @ 2016-05-04 15:37 ` Steve Wise 2016-05-04 21:35 ` Ira Weiny 0 siblings, 1 reply; 14+ messages in thread From: Steve Wise @ 2016-05-04 15:37 UTC (permalink / raw) To: 'Leon Romanovsky', dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w > -----Original Message----- > From: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org [mailto:linux-rdma- > owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org] On Behalf Of Leon Romanovsky > Sent: Wednesday, May 04, 2016 12:36 AM > To: dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org > Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org; markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; majd-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; > matanb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; Leon Romanovsky > Subject: [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in > ibnl_rcv_msg > > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > RDMA_NL_GET_OP is defined like this: (type & ((1 << 10) - 1)) > which means op (defined as an int) can never be a negative number. > > Fixes: b2cbae2c2487 ('RDMA: Add netlink infrastructure') > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > --- > drivers/infiniband/core/netlink.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c > index d47df93..aa491f7 100644 > --- a/drivers/infiniband/core/netlink.c > +++ b/drivers/infiniband/core/netlink.c > @@ -155,8 +155,7 @@ static int ibnl_rcv_msg(struct sk_buff *skb, struct nlmsghdr > *nlh) > > list_for_each_entry(client, &client_list, list) { > if (client->index == index) { > - if (op < 0 || op >= client->nops || > - !client->cb_table[op].dump) > + if (op >= client->nops || !client->cb_table[op].dump) > return -EINVAL; > > /* Should op be made unsigned as well? That would make it clearer. Steve. -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg 2016-05-04 15:37 ` Steve Wise @ 2016-05-04 21:35 ` Ira Weiny 0 siblings, 0 replies; 14+ messages in thread From: Ira Weiny @ 2016-05-04 21:35 UTC (permalink / raw) To: Steve Wise Cc: 'Leon Romanovsky', dledford-H+wXaHxf7aLQT0dZR+AlfA, linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w On Wed, May 04, 2016 at 10:37:10AM -0500, Steve Wise wrote: > > > > > > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > > > RDMA_NL_GET_OP is defined like this: (type & ((1 << 10) - 1)) > > which means op (defined as an int) can never be a negative number. > > > > Fixes: b2cbae2c2487 ('RDMA: Add netlink infrastructure') > > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > > --- > > drivers/infiniband/core/netlink.c | 3 +-- > > 1 file changed, 1 insertion(+), 2 deletions(-) > > > > diff --git a/drivers/infiniband/core/netlink.c > b/drivers/infiniband/core/netlink.c > > index d47df93..aa491f7 100644 > > --- a/drivers/infiniband/core/netlink.c > > +++ b/drivers/infiniband/core/netlink.c > > @@ -155,8 +155,7 @@ static int ibnl_rcv_msg(struct sk_buff *skb, struct > nlmsghdr > > *nlh) > > > > list_for_each_entry(client, &client_list, list) { > > if (client->index == index) { > > - if (op < 0 || op >= client->nops || > > - !client->cb_table[op].dump) > > + if (op >= client->nops || !client->cb_table[op].dump) > > return -EINVAL; > > > > /* > > Should op be made unsigned as well? That would make it clearer. I was going to make the same comment. Ira > > Steve. > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent [not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 5:36 ` [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak Leon Romanovsky 2016-05-04 5:36 ` [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg Leon Romanovsky @ 2016-05-04 5:36 ` Leon Romanovsky [not found] ` <1462340165-16067-4-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 5:36 ` [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb Leon Romanovsky 2016-05-05 6:43 ` [PATCH rdma-next 0/4] Trivial fixes Leon Romanovsky 4 siblings, 1 reply; 14+ messages in thread From: Leon Romanovsky @ 2016-05-04 5:36 UTC (permalink / raw) To: dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w, Leon Romanovsky From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Fix array overrun when going over callback table. In declaration of callback table, the max size isn't provided and in registration phase, it is provided. There is potential scenario where a new operation is added and it is not supported by current client. The acceptance of such operation by ib_netlink will cause to array overrun. Fixes: 809d5fc9bf65 ("infiniband: pass rdma_cm module to netlink_dump_start") Fixes: b493d91d333e ("iwcm: common code for port mapper") Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> --- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/core/sa_query.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 93ab0ae..09a0243 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -4240,7 +4240,7 @@ out: return skb->len; } -static const struct ibnl_client_cbs cma_cb_table[] = { +static const struct ibnl_client_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = { [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats, .module = THIS_MODULE }, }; diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index e28a160..5011ecf 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -59,7 +59,7 @@ MODULE_AUTHOR("Tom Tucker"); MODULE_DESCRIPTION("iWARP CM"); MODULE_LICENSE("Dual BSD/GPL"); -static struct ibnl_client_cbs iwcm_nl_cb_table[] = { +static struct ibnl_client_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = { [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb}, [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb}, [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb}, diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c index 8a09c0f..24c2aac 100644 --- a/drivers/infiniband/core/sa_query.c +++ b/drivers/infiniband/core/sa_query.c @@ -838,7 +838,7 @@ resp_out: return skb->len; } -static struct ibnl_client_cbs ib_sa_cb_table[] = { +static struct ibnl_client_cbs ib_sa_cb_table[RDMA_NL_LS_NUM_OPS] = { [RDMA_NL_LS_OP_RESOLVE] = { .dump = ib_nl_handle_resolve_resp, .module = THIS_MODULE }, -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 14+ messages in thread
[parent not found: <1462340165-16067-4-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>]
* RE: [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent [not found] ` <1462340165-16067-4-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> @ 2016-05-04 15:39 ` Steve Wise 2016-05-04 18:19 ` Jason Gunthorpe 1 sibling, 0 replies; 14+ messages in thread From: Steve Wise @ 2016-05-04 15:39 UTC (permalink / raw) To: 'Leon Romanovsky', dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w > -----Original Message----- > From: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org [mailto:linux-rdma- > owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org] On Behalf Of Leon Romanovsky > Sent: Wednesday, May 04, 2016 12:36 AM > To: dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org > Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org; markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; majd-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; > matanb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; Leon Romanovsky > Subject: [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and > SA agent > > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > Fix array overrun when going over callback table. > In declaration of callback table, the max size isn't provided and > in registration phase, it is provided. > > There is potential scenario where a new operation is added > and it is not supported by current client. The acceptance of > such operation by ib_netlink will cause to array overrun. > > Fixes: 809d5fc9bf65 ("infiniband: pass rdma_cm module to netlink_dump_start") > Fixes: b493d91d333e ("iwcm: common code for port mapper") > Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > --- > drivers/infiniband/core/cma.c | 2 +- > drivers/infiniband/core/iwcm.c | 2 +- > drivers/infiniband/core/sa_query.c | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c > index 93ab0ae..09a0243 100644 > --- a/drivers/infiniband/core/cma.c > +++ b/drivers/infiniband/core/cma.c > @@ -4240,7 +4240,7 @@ out: > return skb->len; > } > > -static const struct ibnl_client_cbs cma_cb_table[] = { > +static const struct ibnl_client_cbs > cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = { > [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats, > .module = THIS_MODULE }, > }; > diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c > index e28a160..5011ecf 100644 > --- a/drivers/infiniband/core/iwcm.c > +++ b/drivers/infiniband/core/iwcm.c > @@ -59,7 +59,7 @@ MODULE_AUTHOR("Tom Tucker"); > MODULE_DESCRIPTION("iWARP CM"); > MODULE_LICENSE("Dual BSD/GPL"); > > -static struct ibnl_client_cbs iwcm_nl_cb_table[] = { > +static struct ibnl_client_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = { > [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb}, > [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb}, > [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = > iwpm_add_and_query_mapping_cb}, > diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c > index 8a09c0f..24c2aac 100644 > --- a/drivers/infiniband/core/sa_query.c > +++ b/drivers/infiniband/core/sa_query.c > @@ -838,7 +838,7 @@ resp_out: > return skb->len; > } > > -static struct ibnl_client_cbs ib_sa_cb_table[] = { > +static struct ibnl_client_cbs ib_sa_cb_table[RDMA_NL_LS_NUM_OPS] = { > [RDMA_NL_LS_OP_RESOLVE] = { > .dump = ib_nl_handle_resolve_resp, > .module = THIS_MODULE }, Looks ok. Reviewed-by: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org> -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent [not found] ` <1462340165-16067-4-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 15:39 ` Steve Wise @ 2016-05-04 18:19 ` Jason Gunthorpe [not found] ` <20160504181922.GA20554-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> 1 sibling, 1 reply; 14+ messages in thread From: Jason Gunthorpe @ 2016-05-04 18:19 UTC (permalink / raw) To: Leon Romanovsky Cc: dledford-H+wXaHxf7aLQT0dZR+AlfA, linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w On Wed, May 04, 2016 at 08:36:04AM +0300, Leon Romanovsky wrote: > -static const struct ibnl_client_cbs cma_cb_table[] = { > +static const struct ibnl_client_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = { > [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats, > .module = THIS_MODULE }, Isn't it much better to change this: if (ibnl_add_client(RDMA_NL_RDMA_CM, RDMA_NL_RDMA_CM_NUM_OPS, cma_cb_table)) to if (ibnl_add_client(RDMA_NL_RDMA_CM, NELEMS(cma_cb_table), cma_cb_table)) And eliminate RDMA_NL_RDMA_CM_NUM_OPS entirely? Jason -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <20160504181922.GA20554-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>]
* Re: [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent [not found] ` <20160504181922.GA20554-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> @ 2016-05-04 21:37 ` Ira Weiny 0 siblings, 0 replies; 14+ messages in thread From: Ira Weiny @ 2016-05-04 21:37 UTC (permalink / raw) To: Jason Gunthorpe Cc: Leon Romanovsky, dledford-H+wXaHxf7aLQT0dZR+AlfA, linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w On Wed, May 04, 2016 at 12:19:22PM -0600, Jason Gunthorpe wrote: > On Wed, May 04, 2016 at 08:36:04AM +0300, Leon Romanovsky wrote: > > > -static const struct ibnl_client_cbs cma_cb_table[] = { > > +static const struct ibnl_client_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = { > > [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats, > > .module = THIS_MODULE }, > > Isn't it much better to change this: > > if (ibnl_add_client(RDMA_NL_RDMA_CM, RDMA_NL_RDMA_CM_NUM_OPS, cma_cb_table)) > > to > if (ibnl_add_client(RDMA_NL_RDMA_CM, NELEMS(cma_cb_table), cma_cb_table)) > > And eliminate RDMA_NL_RDMA_CM_NUM_OPS entirely? Well based on their other series I think we may need to revisit the design pattern of netlink altogether. But yea if we just want to fix this we can do this. Ira > > Jason > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb [not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> ` (2 preceding siblings ...) 2016-05-04 5:36 ` [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent Leon Romanovsky @ 2016-05-04 5:36 ` Leon Romanovsky [not found] ` <1462340165-16067-5-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-05 6:43 ` [PATCH rdma-next 0/4] Trivial fixes Leon Romanovsky 4 siblings, 1 reply; 14+ messages in thread From: Leon Romanovsky @ 2016-05-04 5:36 UTC (permalink / raw) To: dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w, Leon Romanovsky From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Fixes a direct call to kfree_skb when nlmsg_free should be used. Fixes: 2ca546b92a02 ('IB/sa: Route SA pathrecord query through netlink') Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> --- drivers/infiniband/core/sa_query.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c index 24c2aac..5050c61 100644 --- a/drivers/infiniband/core/sa_query.c +++ b/drivers/infiniband/core/sa_query.c @@ -536,7 +536,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query, gfp_t gfp_mask) data = ibnl_put_msg(skb, &nlh, query->seq, 0, RDMA_NL_LS, RDMA_NL_LS_OP_RESOLVE, NLM_F_REQUEST); if (!data) { - kfree_skb(skb); + nlmsg_free(skb); return -EMSGSIZE; } -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply related [flat|nested] 14+ messages in thread
[parent not found: <1462340165-16067-5-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>]
* RE: [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb [not found] ` <1462340165-16067-5-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> @ 2016-05-04 15:42 ` Steve Wise 2016-05-04 21:38 ` Ira Weiny 1 sibling, 0 replies; 14+ messages in thread From: Steve Wise @ 2016-05-04 15:42 UTC (permalink / raw) To: 'Leon Romanovsky', dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w > -----Original Message----- > From: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org [mailto:linux-rdma- > owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org] On Behalf Of Leon Romanovsky > Sent: Wednesday, May 04, 2016 12:36 AM > To: dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org > Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org; markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; majd-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; > matanb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org; Leon Romanovsky > Subject: [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb > > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > Fixes a direct call to kfree_skb when nlmsg_free should be used. > > Fixes: 2ca546b92a02 ('IB/sa: Route SA pathrecord query through netlink') > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > --- > drivers/infiniband/core/sa_query.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c > index 24c2aac..5050c61 100644 > --- a/drivers/infiniband/core/sa_query.c > +++ b/drivers/infiniband/core/sa_query.c > @@ -536,7 +536,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query, gfp_t > gfp_mask) > data = ibnl_put_msg(skb, &nlh, query->seq, 0, RDMA_NL_LS, > RDMA_NL_LS_OP_RESOLVE, NLM_F_REQUEST); > if (!data) { > - kfree_skb(skb); > + nlmsg_free(skb); > return -EMSGSIZE; > } > Looks good. Reviewed-by: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org> -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb [not found] ` <1462340165-16067-5-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> 2016-05-04 15:42 ` Steve Wise @ 2016-05-04 21:38 ` Ira Weiny 1 sibling, 0 replies; 14+ messages in thread From: Ira Weiny @ 2016-05-04 21:38 UTC (permalink / raw) To: Leon Romanovsky Cc: dledford-H+wXaHxf7aLQT0dZR+AlfA, linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w On Wed, May 04, 2016 at 08:36:05AM +0300, Leon Romanovsky wrote: > From: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > > Fixes a direct call to kfree_skb when nlmsg_free should be used. > > Fixes: 2ca546b92a02 ('IB/sa: Route SA pathrecord query through netlink') > Signed-off-by: Mark Bloch <markb-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> Reviewed-by: Ira Weiny <ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org> > --- > drivers/infiniband/core/sa_query.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c > index 24c2aac..5050c61 100644 > --- a/drivers/infiniband/core/sa_query.c > +++ b/drivers/infiniband/core/sa_query.c > @@ -536,7 +536,7 @@ static int ib_nl_send_msg(struct ib_sa_query *query, gfp_t gfp_mask) > data = ibnl_put_msg(skb, &nlh, query->seq, 0, RDMA_NL_LS, > RDMA_NL_LS_OP_RESOLVE, NLM_F_REQUEST); > if (!data) { > - kfree_skb(skb); > + nlmsg_free(skb); > return -EMSGSIZE; > } > > -- > 2.1.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH rdma-next 0/4] Trivial fixes [not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> ` (3 preceding siblings ...) 2016-05-04 5:36 ` [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb Leon Romanovsky @ 2016-05-05 6:43 ` Leon Romanovsky 4 siblings, 0 replies; 14+ messages in thread From: Leon Romanovsky @ 2016-05-05 6:43 UTC (permalink / raw) To: dledford-H+wXaHxf7aLQT0dZR+AlfA Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA, markb-VPRAkNaXOzVWk0Htik3J/w, majd-VPRAkNaXOzVWk0Htik3J/w, matanb-VPRAkNaXOzVWk0Htik3J/w [-- Attachment #1: Type: text/plain, Size: 176 bytes --] On Wed, May 04, 2016 at 08:36:01AM +0300, Leon Romanovsky wrote: > I'm sending to you small collection of trivial fixes to core code. Thanks for the feedback. I'll repost it. [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 819 bytes --] ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2016-05-05 6:43 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-04 5:36 [PATCH rdma-next 0/4] Trivial fixes Leon Romanovsky
[not found] ` <1462340165-16067-1-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-05-04 5:36 ` [PATCH rdma-next 1/4] IB/iwpm: Fix a potential skb leak Leon Romanovsky
[not found] ` <1462340165-16067-2-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-05-04 15:36 ` Steve Wise
2016-05-04 5:36 ` [PATCH rdma-next 2/4] IB/core: Remove unnecessary check in ibnl_rcv_msg Leon Romanovsky
[not found] ` <1462340165-16067-3-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-05-04 15:37 ` Steve Wise
2016-05-04 21:35 ` Ira Weiny
2016-05-04 5:36 ` [PATCH rdma-next 3/4] IB/core: Fix a potential array overrun in CMA and SA agent Leon Romanovsky
[not found] ` <1462340165-16067-4-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-05-04 15:39 ` Steve Wise
2016-05-04 18:19 ` Jason Gunthorpe
[not found] ` <20160504181922.GA20554-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2016-05-04 21:37 ` Ira Weiny
2016-05-04 5:36 ` [PATCH rdma-next 4/4] IB/sa: Use nlmsg_free instead of kfree_skb Leon Romanovsky
[not found] ` <1462340165-16067-5-git-send-email-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-05-04 15:42 ` Steve Wise
2016-05-04 21:38 ` Ira Weiny
2016-05-05 6:43 ` [PATCH rdma-next 0/4] Trivial fixes Leon Romanovsky
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox