diff options
author | Hefty, Sean <sean.hefty@intel.com> | 2011-10-06 16:33:05 (GMT) |
---|---|---|
committer | Roland Dreier <roland@purestorage.com> | 2011-10-06 16:33:05 (GMT) |
commit | b7ab0b19a85fffaa04ad0b59471d3a607eef0a56 (patch) | |
tree | e48057f49cf2c61d11e261e40b963ce79e1eaf12 /drivers/infiniband | |
parent | f45ee80eb0dda1fbf32bf63189627a9e1e157a95 (diff) | |
download | linux-fsl-qoriq-b7ab0b19a85fffaa04ad0b59471d3a607eef0a56.tar.xz |
IB/mad: Verify mgmt class in received MADs
If a received MAD contains an invalid or reserved mgmt class, we will
attempt to access method_table outside of its range. Add a check to
ensure that mgmt class falls within the handled range.
Found by code inspection.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r-- | drivers/infiniband/core/mad.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index b4d8672..0563892 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -1596,6 +1596,9 @@ find_mad_agent(struct ib_mad_port_private *port_priv, mad->mad_hdr.class_version].class; if (!class) goto out; + if (convert_mgmt_class(mad->mad_hdr.mgmt_class) >= + IB_MGMT_MAX_METHODS) + goto out; method = class->method_table[convert_mgmt_class( mad->mad_hdr.mgmt_class)]; if (method) |