linux/drivers/infiniband/ulp
Erez Shitrit 546481c281 IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
When a new CM connection is being requested, ipoib driver copies data
from the path pointer in the CM/tx object, the path object might be
invalid at the point and memory corruption will happened later when now
the CM driver will try using that data.

The next scenario demonstrates it:
	neigh_add_path --> ipoib_cm_create_tx -->
	queue_work (pointer to path is in the cm/tx struct)
	#while the work is still in the queue,
	#the port goes down and causes the ipoib_flush_paths:
	ipoib_flush_paths --> path_free --> kfree(path)
	#at this point the work scheduled starts.
	ipoib_cm_tx_start --> copy from the (invalid)path pointer:
	(memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);)
	 -> memory corruption.

To fix that the driver now starts the CM/tx connection only if that
specific path exists in the general paths database.
This check is protected with the relevant locks, and uses the gid from
the neigh member in the CM/tx object which is valid according to the ref
count that was taken by the CM/tx.

Fixes: 839fcaba35 ('IPoIB: Connected mode experimental support')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-09-02 14:07:38 -04:00
..
ipoib IB/ipoib: Fix memory corruption in ipoib cm mode connect flow 2016-09-02 14:07:38 -04:00
iser IB/core: Enhance ib_map_mr_sg() 2016-05-13 13:37:57 -04:00
isert IB/isert: Properly release resources on DEVICE_REMOVAL 2016-09-02 13:46:32 -04:00
srp IB/srp: Fix srp_map_sg_dma() 2016-06-06 19:32:59 -04:00
srpt IB/srpt: Update sport->port_guid with each port refresh 2016-08-24 16:51:16 -04:00
Makefile IB: Allow build of hw/ and ulp/ subdirectories independently 2014-06-02 14:51:12 -07:00