• Noa Osherovich's avatar
    IB/core: Avoid accessing non-allocated memory when inferring port type · 498ca3c8
    Noa Osherovich authored
    Commit 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
    introduced the concept of type in ah_attr:
     * During ib_register_device, each port is checked for its type which
       is stored in ib_device's port_immutable array.
     * During uverbs' modify_qp, the type is inferred using the port number
       in ib_uverbs_qp_dest struct (address vector) by accessing the
       relevant port_immutable array and the type is passed on to
       providers.
    
    IB spec (version 1.3) enforces a valid port value only in Reset to
    Init. During Init to RTR, the address vector must be valid but port
    number is not mentioned as a field in the address vector, so its
    value is not validated, which leads to accesses to a non-allocated
    memory when inferring the port type.
    
    Save the real port number in ib_qp during modify to Init (when the
    comp_mask indicates that the port number is valid) and use this value
    to infer the port type.
    
    Avoid copying the address vector fields if the matching bit is not set
    in the attr_mask. Address vector can't be modified before the port, so
    no valid flow is affected.
    
    Fixes: 44c58487 ('IB/core: Define 'ib' and 'roce' rdma_ah_attr types')
    Signed-off-by: default avatarNoa Osherovich <noaos@mellanox.com>
    Reviewed-by: default avatarYishai Hadas <yishaih@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    498ca3c8
uverbs_cmd.c 95.3 KB