IB/core: Fix a potential array overrun in CMA and SA agent
authorMark Bloch <markb@mellanox.com>
Fri, 6 May 2016 19:45:26 +0000 (22:45 +0300)
committerDoug Ledford <dledford@redhat.com>
Fri, 13 May 2016 23:40:02 +0000 (19:40 -0400)
commit2fa2d4fb1166d1ef35f0aacac6165d53ab1b89c7
tree01243aeb604a4d0e12d369efc8092f7a89dfe9de
parent1ae5ccc78105490cd1f73bdf4847e7c6d03f0aa1
IB/core: Fix a potential array overrun in CMA and SA agent

Fix array overrun when going over callback table.
In declaration of callback table, the max size isn't provided and
in registration phase, it is provided.

There is potential scenario where a new operation is added
and it is not supported by current client. The acceptance of
such operation by ib_netlink will cause to array overrun.

Fixes: 809d5fc9bf65 ("infiniband: pass rdma_cm module to netlink_dump_start")
Fixes: b493d91d333e ("iwcm: common code for port mapper")
Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/core/cma.c
drivers/infiniband/core/iwcm.c
drivers/infiniband/core/sa_query.c