• Steve Wise's avatar
    RDMA/iwcm: Don't copy past the end of dev_name() string · de3b4f54
    Steve Wise authored
    commit d53ec8af upstream.
    We now use dev_name(&ib_device->dev) instead of ib_device->name in iwpm
    messages.  The name field in struct device is a const char *, where as
    ib_device->name is a char array of size IB_DEVICE_NAME_MAX, and it is
    pre-initialized to zeros.
    Since iw_cm_map() was using memcpy() to copy in the device name, and
    copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the end of the
    source device name string and copying random bytes.  This results in iwpmd
    failing the REGISTER_PID request from iwcm.  Thus port mapping is broken.
    Validate the device and if names, and use strncpy() to inialize the entire
    message field.
    Fixes: 896de009 ("RDMA/core: Use dev_name instead of ibdev->name")
    Cc: stable@vger.kernel.org
    Signed-off-by: 's avatarSteve Wise <swise@opengridcomputing.com>
    Signed-off-by: 's avatarJason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
iwcm.c 33.4 KB