Date: Thu, 2 Aug 2018 08:19:09 +0000 (UTC) From: Hans Petter Selasky <hselasky@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r337081 - stable/11/sys/ofed/drivers/infiniband/core Message-ID: <201808020819.w728J9Xs039778@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: hselasky Date: Thu Aug 2 08:19:08 2018 New Revision: 337081 URL: https://svnweb.freebsd.org/changeset/base/337081 Log: MFC r336375: Fix access to non-initialized CM_ID object in ibcore. The attempt to join multicast group without ensuring that CMA device exists will lead to the following crash reported by syzkaller. Linux commit: 7688f2c3bbf55e52388e37ac5d63ca471a7712e1 Sponsored by: Mellanox Technologies Modified: stable/11/sys/ofed/drivers/infiniband/core/ib_cma.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/ofed/drivers/infiniband/core/ib_cma.c ============================================================================== --- stable/11/sys/ofed/drivers/infiniband/core/ib_cma.c Thu Aug 2 08:18:11 2018 (r337080) +++ stable/11/sys/ofed/drivers/infiniband/core/ib_cma.c Thu Aug 2 08:19:08 2018 (r337081) @@ -4064,6 +4064,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct struct cma_multicast *mc; int ret; + if (!id->device) + return -EINVAL; + id_priv = container_of(id, struct rdma_id_private, id); if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) && !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED))
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201808020819.w728J9Xs039778>