public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
	Doug Ledford <dledford@redhat.com>, Jiri Slaby <jslaby@suse.cz>
Subject: [patch added to the 3.12 stable tree] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly
Date: Fri, 15 May 2015 16:28:23 +0200	[thread overview]
Message-ID: <1431700109-10261-3-git-send-email-jslaby@suse.cz> (raw)
In-Reply-To: <1431700109-10261-1-git-send-email-jslaby@suse.cz>

From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 285214409a9e5fceba2215461b4682b6069d8e77 upstream.

When accepting a new IPv4 connect to an IPv6 socket, the CMA tries to
canonize the address family to IPv4, but does not properly process
the listening sockaddr to get the listening port, and does not properly
set the address family of the canonized sockaddr.

Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager")

Reported-By: Yotam Kenneth <yotamke@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Tested-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/infiniband/core/cma.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index dab4b41f1715..1429143301a7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -840,19 +840,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id
 	memcpy(&ib->sib_addr, &path->dgid, 16);
 }
 
+static __be16 ss_get_port(const struct sockaddr_storage *ss)
+{
+	if (ss->ss_family == AF_INET)
+		return ((struct sockaddr_in *)ss)->sin_port;
+	else if (ss->ss_family == AF_INET6)
+		return ((struct sockaddr_in6 *)ss)->sin6_port;
+	BUG();
+}
+
 static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
 			      struct cma_hdr *hdr)
 {
-	struct sockaddr_in *listen4, *ip4;
+	struct sockaddr_in *ip4;
 
-	listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr;
 	ip4 = (struct sockaddr_in *) &id->route.addr.src_addr;
-	ip4->sin_family = listen4->sin_family;
+	ip4->sin_family = AF_INET;
 	ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr;
-	ip4->sin_port = listen4->sin_port;
+	ip4->sin_port = ss_get_port(&listen_id->route.addr.src_addr);
 
 	ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr;
-	ip4->sin_family = listen4->sin_family;
+	ip4->sin_family = AF_INET;
 	ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr;
 	ip4->sin_port = hdr->port;
 }
@@ -860,16 +868,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_i
 static void cma_save_ip6_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
 			      struct cma_hdr *hdr)
 {
-	struct sockaddr_in6 *listen6, *ip6;
+	struct sockaddr_in6 *ip6;
 
-	listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr;
 	ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr;
-	ip6->sin6_family = listen6->sin6_family;
+	ip6->sin6_family = AF_INET6;
 	ip6->sin6_addr = hdr->dst_addr.ip6;
-	ip6->sin6_port = listen6->sin6_port;
+	ip6->sin6_port = ss_get_port(&listen_id->route.addr.src_addr);
 
 	ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr;
-	ip6->sin6_family = listen6->sin6_family;
+	ip6->sin6_family = AF_INET6;
 	ip6->sin6_addr = hdr->src_addr.ip6;
 	ip6->sin6_port = hdr->port;
 }
-- 
2.3.7


  parent reply	other threads:[~2015-05-15 14:28 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-05-15 14:28 [patch added to the 3.12 stable tree] ocfs2: dlm: fix race between purge and get lock resource Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() Jiri Slaby
2015-05-15 14:28 ` Jiri Slaby [this message]
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] gpio: sysfs: fix memory leaks and device hotplug Jiri Slaby
2015-05-15 14:51   ` Johan Hovold
2015-05-15 19:51     ` Jiri Slaby
2015-05-15 20:24       ` Johan Hovold
2015-05-16  6:42         ` Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] mnt: Fix fs_fully_visible to verify the root directory is visible Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] mm/memory-failure: call shake_page() when error hits thp tail page Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] writeback: use |1 instead of +1 to protect against div by zero Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] mm: soft-offline: fix num_poisoned_pages counting on concurrent events Jiri Slaby
2015-05-15 14:28 ` [patch added to the 3.12 stable tree] xen/console: Update console event channel on resume Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1431700109-10261-3-git-send-email-jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=dledford@redhat.com \
    --cc=jgunthorpe@obsidianresearch.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox