mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-21 03:33:59 +08:00
libfc: sanity check cpu number extracted from xid
In the receive path libfc extracts a cpu number from the ox_id in the fiber channel header and uses that to do a per_cpu_ptr conversion. If, for some reason, a frame is received with an invalid ox_id, per_cpu_ptr will return an invalid pointer and the libfc receive path will panic the system trying to use it. I'm currently looking at such a case, and I don't yet know why a cpu number > nr_cpu_ids is appearing in an exchange id. But adding a sanity check in libfc prevents a system panic, and seems like good idea when dealing with frames coming in from the network. Signed-off-by: Chris Leech <cleech@redhat.com> Acked-by: Johannes Thumshirn <jth@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
4b9bc86d5a
commit
fa06883281
@ -908,9 +908,17 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid)
|
||||
{
|
||||
struct fc_exch_pool *pool;
|
||||
struct fc_exch *ep = NULL;
|
||||
u16 cpu = xid & fc_cpu_mask;
|
||||
|
||||
if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) {
|
||||
printk_ratelimited(KERN_ERR
|
||||
"libfc: lookup request for XID = %d, "
|
||||
"indicates invalid CPU %d\n", xid, cpu);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if ((xid >= mp->min_xid) && (xid <= mp->max_xid)) {
|
||||
pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask);
|
||||
pool = per_cpu_ptr(mp->pool, cpu);
|
||||
spin_lock_bh(&pool->lock);
|
||||
ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order);
|
||||
if (ep) {
|
||||
|
Loading…
Reference in New Issue
Block a user