• Parav Pandit's avatar
    IB/cm: Fix memory corruption in handling CM request · 5a3dc323
    Parav Pandit authored
    In recent code, two path record entries are alwasy cleared while
    allocated could be either one or two path record entries.
    This leads to zero out of unallocated memory.
    
    This fix initializes alternative path record only when alternative path
    is set.
    
    While we are at it, path record allocation doesn't check for OPA
    alternative path, but rest of the code checks for OPA alternative path.
    Path record allocation code doesn't check for OPA alternative LID.
    This can further lead to memory corruption when only one path record is
    allocated, but there is actually alternative OPA path record present in CM
    request.
    
    Cc: <stable@vger.kernel.org> # v4.12+
    Fixes: 9fdca4da ("IB/SA: Split struct sa_path_rec based on IB and ROCE specific fields")
    Signed-off-by: default avatarParav Pandit <parav@mellanox.com>
    Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    5a3dc323
cm.c 122 KB