diff options
| author |   Mustafa Ismail <mustafa.ismail@intel.com> | 2022-07-05 18:08:14 -0500 |
|---|---|---|
| committer |   Leon Romanovsky <leonro@nvidia.com> | 2022-07-18 10:40:05 +0300 |
| commit | 82ab2b52654c43ba24a3f6603fec40874cc5a7e5 (patch) | |
| tree | 0cf9a5a8a445f0b3023b6cea71a770b176c4f0fa /drivers/infiniband/hw/irdma | |
| parent | RDMA/irdma: Fix a window for use-after-free (diff) | |
| download | linux-dev-82ab2b52654c43ba24a3f6603fec40874cc5a7e5.tar.xz linux-dev-82ab2b52654c43ba24a3f6603fec40874cc5a7e5.zip | |
RDMA/irdma: Fix VLAN connection with wildcard address
When an application listens on a wildcard address, and there are VLAN and
non-VLAN IP addresses, iWARP connection establishemnt can fail if the listen
node VLAN ID does not match.
Fix this by checking the vlan_id only if not a wildcard listen node.
Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
Link: https://lore.kernel.org/r/20220705230815.265-7-shiraz.saleem@intel.com
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/hw/irdma')
| -rw-r--r-- | drivers/infiniband/hw/irdma/cm.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c index 638bf4a1ed94..e4d837f82d75 100644 --- a/drivers/infiniband/hw/irdma/cm.c +++ b/drivers/infiniband/hw/irdma/cm.c @@ -1477,12 +1477,13 @@ irdma_find_listener(struct irdma_cm_core *cm_core, u32 *dst_addr, u16 dst_port, list_for_each_entry (listen_node, &cm_core->listen_list, list) { memcpy(listen_addr, listen_node->loc_addr, sizeof(listen_addr)); listen_port = listen_node->loc_port; + if (listen_port != dst_port || + !(listener_state & listen_node->listener_state)) + continue; /* compare node pair, return node handle if a match */ - if ((!memcmp(listen_addr, dst_addr, sizeof(listen_addr)) || - !memcmp(listen_addr, ip_zero, sizeof(listen_addr))) && - listen_port == dst_port && - vlan_id == listen_node->vlan_id && - (listener_state & listen_node->listener_state)) { + if (!memcmp(listen_addr, ip_zero, sizeof(listen_addr)) || + (!memcmp(listen_addr, dst_addr, sizeof(listen_addr)) && + vlan_id == listen_node->vlan_id)) { refcount_inc(&listen_node->refcnt); spin_unlock_irqrestore(&cm_core->listen_list_lock, flags); |