Skip to content

Commit d1c803a

Browse files
rleonjgunthorpe
authored andcommitted
RDMA/addr: Be strict with gid size
The nla_len() is less than or equal to 16. If it's less than 16 then end of the "gid" buffer is uninitialized. Fixes: ae43f82 ("IB/core: Add IP to GID netlink offload") Link: https://lore.kernel.org/r/20210405074434.264221-1-leon@kernel.org Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
1 parent e1ad897 commit d1c803a

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

drivers/infiniband/core/addr.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq;
7676

7777
static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {
7878
[LS_NLA_TYPE_DGID] = {.type = NLA_BINARY,
79-
.len = sizeof(struct rdma_nla_ls_gid)},
79+
.len = sizeof(struct rdma_nla_ls_gid),
80+
.validation_type = NLA_VALIDATE_MIN,
81+
.min = sizeof(struct rdma_nla_ls_gid)},
8082
};
8183

8284
static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)

0 commit comments

Comments
 (0)