summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core
diff options
context:
space:
mode:
authorHefty, Sean <sean.hefty@intel.com>2011-10-06 09:33:05 -0700
committerRoland Dreier <roland@purestorage.com>2011-10-06 09:33:05 -0700
commitb7ab0b19a85fffaa04ad0b59471d3a607eef0a56 (patch)
treee48057f49cf2c61d11e261e40b963ce79e1eaf12 /drivers/infiniband/core
parentf45ee80eb0dda1fbf32bf63189627a9e1e157a95 (diff)
IB/mad: Verify mgmt class in received MADs
If a received MAD contains an invalid or reserved mgmt class, we will attempt to access method_table outside of its range. Add a check to ensure that mgmt class falls within the handled range. Found by code inspection. Signed-off-by: Sean Hefty <sean.hefty@intel.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/core')
-rw-r--r--drivers/infiniband/core/mad.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index b4d8672a3e4..056389229ea 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1596,6 +1596,9 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
mad->mad_hdr.class_version].class;
if (!class)
goto out;
+ if (convert_mgmt_class(mad->mad_hdr.mgmt_class) >=
+ IB_MGMT_MAX_METHODS)
+ goto out;
method = class->method_table[convert_mgmt_class(
mad->mad_hdr.mgmt_class)];
if (method)