1. 21 Jan, 2016 1 commit
    • Kaike Wan's avatar
      IB/sa: Fix netlink local service GFP crash · 2deeb477
      Kaike Wan authored
      The rdma netlink local service registers a handler to handle RESOLVE
      response and another handler to handle SET_TIMEOUT request. The first
      thing these handlers do is to call netlink_capable() to check the
      access right of the received skb to make sure that the sender has root
      access. Under normal conditions, such responses and requests will be
      directly forwarded to the handlers without going through the netlink_dump
      pathway (see ibnl_rcv_msg() in drivers/infiniband/core/netlink.c).
      However, a user application could send a RESOLVE request (not response)
      to the local service, which will fall into the netlink_dump pathway,
      where a new skb will be created without initializing the control block.
      This new skb will be eventually forwarded to the local service RESOLVE
      response handler. Unfortunately, netlink_capable() will cause general
      protection fault if the skb's control block is not initialized. This
      patch will address the problem by checking the skb first.
      Signed-off-by: default avatarKaike Wan <kaike.wan@intel.com>
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      2deeb477
  2. 19 Jan, 2016 39 commits