提交 8b2c7e7a 编写于 作者: L Leon Romanovsky 提交者: Linus Torvalds

RDAM/netlink: Fix out-of-bound access while checking message validity

The netlink message sent with type == 0, which doesn't have any client
behind it, caused to the overflow in max_num_ops array.

Fix it by declaring zero number of ops for the first client.

Fixes: c9901724 ("RDMA/netlink: Remove netlink clients infrastructure")
Signed-off-by: NLeon Romanovsky <leon@kernel.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 5969d1bb
......@@ -57,7 +57,8 @@ EXPORT_SYMBOL(rdma_nl_chk_listeners);
static bool is_nl_msg_valid(unsigned int type, unsigned int op)
{
static const unsigned int max_num_ops[RDMA_NL_NUM_CLIENTS - 1] = {
static const unsigned int max_num_ops[RDMA_NL_NUM_CLIENTS] = {
0,
RDMA_NL_RDMA_CM_NUM_OPS,
RDMA_NL_IWPM_NUM_OPS,
0,
......@@ -70,10 +71,10 @@ static bool is_nl_msg_valid(unsigned int type, unsigned int op)
*/
BUILD_BUG_ON(RDMA_NL_NUM_CLIENTS != 6);
if (type > RDMA_NL_NUM_CLIENTS - 1)
if (type >= RDMA_NL_NUM_CLIENTS)
return false;
return (op < max_num_ops[type - 1]) ? true : false;
return (op < max_num_ops[type]) ? true : false;
}
static bool is_nl_valid(unsigned int type, unsigned int op)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册