netdev - [PATCH] infiniband: make sure the src net is infiniband when create new link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1388655458-25269-1-git-send-email-liuhangbin@gmail.com>
Date:	Thu,  2 Jan 2014 17:37:38 +0800
From:	Hangbin Liu <liuhangbin@...il.com>
To:	network dev <netdev@...r.kernel.org>
Cc:	David Miller <davem@...emloft.net>, Weiping Pan <wpan@...hat.com>,
	Hangbin Liu <liuhangbin@...il.com>
Subject: [PATCH] infiniband: make sure the src net is infiniband when create new link

When we create a new infiniband link with uninfiniband device, e.g. `ip link
add link em1 type ipoib pkey 0x8001`. We will get a NULL pointer dereference
cause other dev like Ethernet don't have struct ib_device.

The code path is:
rtnl_newlink
  |-- ipoib_new_child_link
        |-- __ipoib_vlan_add
              |-- ipoib_set_dev_features
	            |-- ib_query_device

Fix this bug by make sure the src net is infiniband when create new link.

Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
---
 drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index c29b5c8..de340c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/netdevice.h>
+#include <linux/if_arp.h>	/* For ARPHRD_xxx */
 #include <linux/module.h>
 #include <net/rtnetlink.h>
 #include "ipoib.h"
@@ -105,6 +106,8 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
 	pdev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
 	if (!pdev)
 		return -ENODEV;
+	if (pdev->type != ARPHRD_INFINIBAND)
+		return -ENODEV;
 
 	ppriv = netdev_priv(pdev);
 
-- 
1.8.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html