• Erez Shitrit's avatar
    IB/ipoib: Avoid memory leak if the SA returns a different DGID · 43900089
    Erez Shitrit authored
    The ipoib path database is organized around DGIDs from the LLADDR, but the
    SA is free to return a different GID when asked for path. This causes a
    bug because the SA's modified DGID is copied into the database key, even
    though it is no longer the correct lookup key, causing a memory leak and
    other malfunctions.
    
    Ensure the database key does not change after the SA query completes.
    
    Demonstration of the bug is as  follows
    ipoib wants to send to GID fe80:0000:0000:0000:0002:c903:00ef:5ee2, it
    creates new record in the DB with that gid as a key, and issues a new
    request to the SM.
    Now, the SM from some reason returns path-record with other SGID (for
    example, 2001:0000:0000:0000:0002:c903:00ef:5ee2 that contains the local
    subnet prefix) now ipoib will overwrite the current entry with the new
    one, and if new request to the original GID arrives ipoib  will not find
    it in the DB (was overwritten) and will create new record that in its
    turn will also be overwritten by the response from the SM, and so on
    till the driver eats all the device memory.
    Signed-off-by: default avatarErez Shitrit <erezsh@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    43900089
ipoib_main.c 61 KB