diff options
| author |   Mark Bloch <markb@mellanox.com> | 2016-05-06 22:45:26 +0300 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2016-05-13 19:40:02 -0400 |
| commit | 2fa2d4fb1166d1ef35f0aacac6165d53ab1b89c7 (patch) | |
| tree | 01243aeb604a4d0e12d369efc8092f7a89dfe9de /drivers/infiniband/core/iwcm.c | |
| parent | IB/core: Remove unnecessary check in ibnl_rcv_msg (diff) | |
| download | linux-dev-2fa2d4fb1166d1ef35f0aacac6165d53ab1b89c7.tar.xz linux-dev-2fa2d4fb1166d1ef35f0aacac6165d53ab1b89c7.zip | |
IB/core: Fix a potential array overrun in CMA and SA agent
Fix array overrun when going over callback table.
In declaration of callback table, the max size isn't provided and
in registration phase, it is provided.
There is potential scenario where a new operation is added
and it is not supported by current client. The acceptance of
such operation by ib_netlink will cause to array overrun.
Fixes: 809d5fc9bf65 ("infiniband: pass rdma_cm module to netlink_dump_start")
Fixes: b493d91d333e ("iwcm: common code for port mapper")
Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/core/iwcm.c')
| -rw-r--r-- | drivers/infiniband/core/iwcm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index fe0bd6c9df3d..f0572049d291 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -1175,7 +1175,7 @@ static int __init iw_cm_init(void) if (ret) pr_err("iw_cm: couldn't init iwpm\n"); - ret = ibnl_add_client(RDMA_NL_IWCM, RDMA_NL_IWPM_NUM_OPS, + ret = ibnl_add_client(RDMA_NL_IWCM, ARRAY_SIZE(iwcm_nl_cb_table), iwcm_nl_cb_table); if (ret) pr_err("iw_cm: couldn't register netlink callbacks\n"); |