IB/cm: Fix memory corruption in handling CM request
authorParav Pandit <parav@mellanox.com>
Thu, 19 Oct 2017 05:40:30 +0000 (08:40 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 30 Nov 2017 08:40:54 +0000 (08:40 +0000)
commit5449283f245d85c80077fd024491de5ae0e40907
treec63e251ee92f976423f65243378f249f022bbdd4
parentd56fd8a032ab2879b70f9b69c4f59713552c1f9a
IB/cm: Fix memory corruption in handling CM request

commit 5a3dc32372439eb9a0d6027c54cbfff64803fce5 upstream.

In recent code, two path record entries are alwasy cleared while
allocated could be either one or two path record entries.
This leads to zero out of unallocated memory.

This fix initializes alternative path record only when alternative path
is set.

While we are at it, path record allocation doesn't check for OPA
alternative path, but rest of the code checks for OPA alternative path.
Path record allocation code doesn't check for OPA alternative LID.
This can further lead to memory corruption when only one path record is
allocated, but there is actually alternative OPA path record present in CM
request.

Fixes: 9fdca4da4d8c ("IB/SA: Split struct sa_path_rec based on IB and ROCE specific fields")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/core/cm.c