linux-kernel - [PATCH 3.4 074/146] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Sep 2015 17:03:09 +0800
From:	lizf@...nel.org
To:	stable@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org,
	Jason Gunthorpe <jgunthorpe@...idianresearch.com>,
	Doug Ledford <dledford@...hat.com>,
	Zefan Li <lizefan@...wei.com>
Subject: [PATCH 3.4 074/146] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly

From: Jason Gunthorpe <jgunthorpe@...idianresearch.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 285214409a9e5fceba2215461b4682b6069d8e77 upstream.

When accepting a new IPv4 connect to an IPv6 socket, the CMA tries to
canonize the address family to IPv4, but does not properly process
the listening sockaddr to get the listening port, and does not properly
set the address family of the canonized sockaddr.

Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager")

Reported-By: Yotam Kenneth <yotamke@...lanox.com>
Signed-off-by: Jason Gunthorpe <jgunthorpe@...idianresearch.com>
Tested-by: Haggai Eran <haggaie@...lanox.com>
Signed-off-by: Doug Ledford <dledford@...hat.com>
[lizf: Backported to 3.4:
 - there's no cma_save_ip4_info() and cma_save_ip6_info(), and instead
   we apply the changes to cma_save_net_info()]
Signed-off-by: Zefan Li <lizefan@...wei.com>
---
 drivers/infiniband/core/cma.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 67432e2..8987a9a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, enum rdma_port_space ps,
 	return 0;
 }
 
+static __be16 ss_get_port(const struct sockaddr_storage *ss)
+{
+	if (ss->ss_family == AF_INET)
+		return ((struct sockaddr_in *)ss)->sin_port;
+	else if (ss->ss_family == AF_INET6)
+		return ((struct sockaddr_in6 *)ss)->sin6_port;
+	BUG();
+}
+
 static void cma_save_net_info(struct rdma_addr *addr,
 			      struct rdma_addr *listen_addr,
 			      u8 ip_ver, __be16 port,
 			      union cma_ip_addr *src, union cma_ip_addr *dst)
 {
-	struct sockaddr_in *listen4, *ip4;
-	struct sockaddr_in6 *listen6, *ip6;
+	struct sockaddr_in *ip4;
+	struct sockaddr_in6 *ip6;
 
 	switch (ip_ver) {
 	case 4:
-		listen4 = (struct sockaddr_in *) &listen_addr->src_addr;
 		ip4 = (struct sockaddr_in *) &addr->src_addr;
-		ip4->sin_family = listen4->sin_family;
+		ip4->sin_family = AF_INET;;
 		ip4->sin_addr.s_addr = dst->ip4.addr;
-		ip4->sin_port = listen4->sin_port;
+		ip4->sin_port = ss_get_port(&listen_addr->src_addr);
 
 		ip4 = (struct sockaddr_in *) &addr->dst_addr;
-		ip4->sin_family = listen4->sin_family;
+		ip4->sin_family = AF_INET;
 		ip4->sin_addr.s_addr = src->ip4.addr;
 		ip4->sin_port = port;
 		break;
 	case 6:
-		listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr;
 		ip6 = (struct sockaddr_in6 *) &addr->src_addr;
-		ip6->sin6_family = listen6->sin6_family;
+		ip6->sin6_family = AF_INET6;
 		ip6->sin6_addr = dst->ip6;
-		ip6->sin6_port = listen6->sin6_port;
+		ip6->sin6_port = ss_get_port(&listen_addr->src_addr);
 
 		ip6 = (struct sockaddr_in6 *) &addr->dst_addr;
-		ip6->sin6_family = listen6->sin6_family;
+		ip6->sin6_family = AF_INET6;
 		ip6->sin6_addr = src->ip6;
 		ip6->sin6_port = port;
 		break;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/