* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/iser: Support iSCSI PDU padding IBiser: Fix wrong mask when sizeof (dma_addr_t) > sizeof (unsigned long) IPoIB: Fix possible NULL dereference in ipoib_start_xmit()
Unified · Split
| @@ -717,11 +717,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev) · 716 unmodified lines | |||
| 717 | { | 717 | { |
| 718 | struct ipoib_dev_priv *priv = netdev_priv(dev); | 718 | struct ipoib_dev_priv *priv = netdev_priv(dev); |
| 719 | struct ipoib_neigh *neigh; | 719 | struct ipoib_neigh *neigh; |
| 720 | struct neighbour *n; | 720 | struct neighbour *n = NULL; |
| 721 | unsigned long flags; | 721 | unsigned long flags; |
| 722 | 722 | ||
| 723 | n = dst_get_neighbour(skb_dst(skb)); | 723 | if (likely(skb_dst(skb))) |
| 724 | if (likely(skb_dst(skb) && n)) { | 724 | n = dst_get_neighbour(skb_dst(skb)); |
| 725 | |||
| 726 | if (likely(n)) { | ||
| 725 | if (unlikely(!*to_ipoib_neigh(n))) { | 727 | if (unlikely(!*to_ipoib_neigh(n))) { |
| 726 | ipoib_path_lookup(skb, dev); | 728 | ipoib_path_lookup(skb, dev); |
| 727 | return NETDEV_TX_OK; | 729 | return NETDEV_TX_OK; |
| @@ -101,13 +101,17 @@ iscsi_iser_recv(struct iscsi_conn *conn, · 100 unmodified lines | |||
| 101 | 101 | ||
| 102 | /* verify PDU length */ | 102 | /* verify PDU length */ |
| 103 | datalen = ntoh24(hdr->dlength); | 103 | datalen = ntoh24(hdr->dlength); |
| 104 | if (datalen != rx_data_len) { | 104 | if (datalen > rx_data_len || (datalen + 4) < rx_data_len) { |
| 105 | printk(KERN_ERR "iscsi_iser: datalen %d (hdr) != %d (IB) \n", | 105 | iser_err("wrong datalen %d (hdr), %d (IB)\n", |
| 106 | datalen, rx_data_len); | 106 | datalen, rx_data_len); |
| 107 | rc = ISCSI_ERR_DATALEN; | 107 | rc = ISCSI_ERR_DATALEN; |
| 108 | goto error; | 108 | goto error; |
| 109 | } | 109 | } |
| 110 | 110 | ||
| 111 | if (datalen != rx_data_len) | ||
| 112 | iser_dbg("aligned datalen (%d) hdr, %d (IB)\n", | ||
| 113 | datalen, rx_data_len); | ||
| 114 | |||
| 111 | /* read AHS */ | 115 | /* read AHS */ |
| 112 | ahslen = hdr->hlength * 4; | 116 | ahslen = hdr->hlength * 4; |
| 113 | 117 | ||
| @@ -89,7 +89,7 @@ · 88 unmodified lines | |||
| 89 | } while (0) | 89 | } while (0) |
| 90 | 90 | ||
| 91 | #define SHIFT_4K 12 | 91 | #define SHIFT_4K 12 |
| 92 | #define SIZE_4K (1UL << SHIFT_4K) | 92 | #define SIZE_4K (1ULL << SHIFT_4K) |
| 93 | #define MASK_4K (~(SIZE_4K-1)) | 93 | #define MASK_4K (~(SIZE_4K-1)) |
| 94 | 94 | ||
| 95 | /* support up to 512KB in one RDMA */ | 95 | /* support up to 512KB in one RDMA */ |
| @@ -412,7 +412,7 @@ int iser_send_control(struct iscsi_conn *conn, · 411 unmodified lines | |||
| 412 | memcpy(iser_conn->ib_conn->login_buf, task->data, | 412 | memcpy(iser_conn->ib_conn->login_buf, task->data, |
| 413 | task->data_count); | 413 | task->data_count); |
| 414 | tx_dsg->addr = iser_conn->ib_conn->login_dma; | 414 | tx_dsg->addr = iser_conn->ib_conn->login_dma; |
| 415 | tx_dsg->length = data_seg_len; | 415 | tx_dsg->length = task->data_count; |
| 416 | tx_dsg->lkey = device->mr->lkey; | 416 | tx_dsg->lkey = device->mr->lkey; |
| 417 | mdesc->num_sge = 2; | 417 | mdesc->num_sge = 2; |
| 418 | } | 418 | } |