mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 12:57:53 +00:00
Code Issues Releases Wiki Activity

[SCSI] libfcoe: Handle duplicate critical descriptors

Browse source 
As per FC-BB-5 rev 2, section 7.8.6.2, malformed FIP frame shall be
discarded. Drop discovery adv, ELS and CLV's with duplicate critical
descriptors.

[Resending after incorporating Joe's review comments]

Signed-off-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
This commit is contained in:
Bhanu Prakash Gollapudi 2010-06-11 16:44:25 -07:00 committed by James Bottomley
parent c600fea2d8
commit 0a9c5d344d
1 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
drivers/scsi/fcoe/libfcoe.c
View file

@ -640,6 +640,7 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
unsigned long t;
size_t rlen;
size_t dlen;
u32 desc_mask;
memset(fcf, 0, sizeof(*fcf));
fcf->fka_period = msecs_to_jiffies(FCOE_CTLR_DEF_FKA);
@ -647,6 +648,12 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
fiph = (struct fip_header *)skb->data;
fcf->flags = ntohs(fiph->fip_flags);
/*
* mask of required descriptors. validating each one clears its bit.
*/
desc_mask = BIT(FIP_DT_PRI) | BIT(FIP_DT_MAC) | BIT(FIP_DT_NAME) |
BIT(FIP_DT_FAB) | BIT(FIP_DT_FKA);
rlen = ntohs(fiph->fip_dl_len) * 4;
if (rlen + sizeof(*fiph) > skb->len)
return -EINVAL;
@ -656,11 +663,19 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
dlen = desc->fip_dlen * FIP_BPW;
if (dlen < sizeof(*desc) || dlen > rlen)
return -EINVAL;
/* Drop Adv if there are duplicate critical descriptors */
if ((desc->fip_dtype < 32) &&
!(desc_mask & 1U << desc->fip_dtype)) {
LIBFCOE_FIP_DBG(fip, "Duplicate Critical "
"Descriptors in FIP adv\n");
return -EINVAL;
}
switch (desc->fip_dtype) {
case FIP_DT_PRI:
if (dlen != sizeof(struct fip_pri_desc))
goto len_err;
fcf->pri = ((struct fip_pri_desc *)desc)->fd_pri;
desc_mask &= ~BIT(FIP_DT_PRI);
break;
case FIP_DT_MAC:
if (dlen != sizeof(struct fip_mac_desc))
@ -673,12 +688,14 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
"in FIP adv\n");
return -EINVAL;
}
desc_mask &= ~BIT(FIP_DT_MAC);
break;
case FIP_DT_NAME:
if (dlen != sizeof(struct fip_wwn_desc))
goto len_err;
wwn = (struct fip_wwn_desc *)desc;
fcf->switch_name = get_unaligned_be64(&wwn->fd_wwn);
desc_mask &= ~BIT(FIP_DT_NAME);
break;
case FIP_DT_FAB:
if (dlen != sizeof(struct fip_fab_desc))
@ -687,6 +704,7 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
fcf->fabric_name = get_unaligned_be64(&fab->fd_wwn);
fcf->vfid = ntohs(fab->fd_vfid);
fcf->fc_map = ntoh24(fab->fd_map);
desc_mask &= ~BIT(FIP_DT_FAB);
break;
case FIP_DT_FKA:
if (dlen != sizeof(struct fip_fka_desc))
@ -697,6 +715,7 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
t = ntohl(fka->fd_fka_period);
if (t >= FCOE_CTLR_MIN_FKA)
fcf->fka_period = msecs_to_jiffies(t);
desc_mask &= ~BIT(FIP_DT_FKA);
break;
case FIP_DT_MAP_OUI:
case FIP_DT_FCOE_SIZE:
@ -719,6 +738,11 @@ static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
return -EINVAL;
if (!fcf->switch_name || !fcf->fabric_name)
return -EINVAL;
if (desc_mask) {
LIBFCOE_FIP_DBG(fip, "adv missing descriptors mask %x\n",
desc_mask);
return -EINVAL;
}
return 0;
len_err:
@ -847,6 +871,7 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
size_t els_len = 0;
size_t rlen;
size_t dlen;
u32 dupl_desc = 0;
fiph = (struct fip_header *)skb->data;
sub = fiph->fip_subcode;
@ -862,6 +887,15 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
dlen = desc->fip_dlen * FIP_BPW;
if (dlen < sizeof(*desc) || dlen > rlen)
goto drop;
/* Drop ELS if there are duplicate critical descriptors */
if (desc->fip_dtype < 32) {
if (dupl_desc & 1U << desc->fip_dtype) {
LIBFCOE_FIP_DBG(fip, "Duplicate Critical "
"Descriptors in FIP ELS\n");
goto drop;
}
dupl_desc |= (1 << desc->fip_dtype);
}
switch (desc->fip_dtype) {
case FIP_DT_MAC:
if (dlen != sizeof(struct fip_mac_desc))
@ -973,6 +1007,13 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
dlen = desc->fip_dlen * FIP_BPW;
if (dlen > rlen)
return;
/* Drop CVL if there are duplicate critical descriptors */
if ((desc->fip_dtype < 32) &&
!(desc_mask & 1U << desc->fip_dtype)) {
LIBFCOE_FIP_DBG(fip, "Duplicate Critical "
"Descriptors in FIP CVL\n");
return;
}
switch (desc->fip_dtype) {
case FIP_DT_MAC:
mp = (struct fip_mac_desc *)desc;