Fixing the bug when NDIS sends OID_GEN_NETWORK_LAYER_ADDRESSES with the
list of new addresses with invalid formatting (happened when AddressCount =5)
NDIS sends NETWORK_ADDRESS_LIST structure, which contains an array of
NETWORK_ADDRESS structures of variable size.
The calculation of the next address offset is based on AddressLength;
in a case when this field contains wrong data, one can get access violation
error
Signed-off by: Alexander Naslednikov (xalex at mellanox.co.il)
Index: B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c
===================================================================
--- B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c (revision
6298)
+++ B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c (revision
6299)
@@ -2210,30 +2210,27 @@
cl_vector_get_ptr( &p_adapter->ip_vector, idx );
p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;
- for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
- p_net_addr_oid->AddressLength) )
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of
0x%.4X, "
- "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation (happened when AddressCount
was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of
%d, "
"should be %d\n", port_num, i, p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );
+ break;
}
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+ FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+ p_net_addr_oid->AddressLength) ;
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
if( !cl_memcmp( &p_ip_addr->in_addr,
&p_addr_item->address.as_ulong, sizeof(ULONG) ) )
@@ -2273,36 +2270,37 @@
/* Now look for new addresses */
p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;
idx = 0;
- for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) + p_net_addr_oid->AddressLength) )
+
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of
0x%.4X, "
- "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation (happened when AddressCount
was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of
%d, "
"should be %d\n", port_num, i, p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );
+ break;
+
}
-
+
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+ FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+ p_net_addr_oid->AddressLength) ;
+
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
/* Size the vector as needed. */
if( cl_vector_get_size( &p_adapter->ip_vector ) <= idx )
cl_vector_set_size( &p_adapter->ip_vector, idx + 1 );
- p_addr_item = cl_vector_get_ptr( &p_adapter->ip_vector, idx );
+ p_addr_item = (net_address_item_t *) cl_vector_get_ptr(
&p_adapter->ip_vector, idx );
if( !cl_memcmp( &p_ip_addr->in_addr, &p_addr_item->address.as_ulong,
sizeof(ULONG) ) )
{
Index:
B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
===================================================================
--- B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
(revision 6298)
+++ B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
(revision 6299)
@@ -3514,30 +3514,27 @@
cl_vector_get_ptr( &p_adapter->ip_vector, idx );
p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;
- for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
- p_net_addr_oid->AddressLength) )
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of
0x%.4X, "
- "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation (happened when AddressCount
was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of
%d, "
"should be %d\n", port_num, i, p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );
+ break;
}
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+ FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+ p_net_addr_oid->AddressLength) ;
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
if( !cl_memcmp( &p_ip_addr->in_addr,
&p_addr_item->address.as_ulong, sizeof(ULONG) ) )
@@ -3577,29 +3574,30 @@
/* Now look for new addresses */
p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;
idx = 0;
- for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) + p_net_addr_oid->AddressLength) )
+
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of
0x%.4X, "
- "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation (happened when AddressCount
was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of
%d, "
"should be %d\n", port_num, i, p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );
+ break;
+
}
-
+
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+ FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+ p_net_addr_oid->AddressLength) ;
+
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
/* Size the vector as needed. */
Fixing the bug when NDIS sends OID_GEN_NETWORK_LAYER_ADDRESSES with the
list of new addresses with invalid formatting (happened when AddressCount =5)
NDIS sends NETWORK_ADDRESS_LIST structure, which contains an array of
NETWORK_ADDRESS structures of variable size.
The calculation of the next address offset is based on AddressLength;
in a case when this field contains wrong data, one can get access violation
error
Signed-off by: Alexander Naslednikov (xalex at mellanox.co.il)
Index: B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c
===================================================================
--- B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c
(revision 6298)
+++ B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib/kernel/ipoib_driver.c
(revision 6299)
@@ -2210,30 +2210,27 @@
cl_vector_get_ptr( &p_adapter->ip_vector, idx );
p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;
- for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
- p_net_addr_oid->AddressLength) )
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType !=
NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
- ("Port %d
OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "
- "should be 0x%.4X\n", port_num,
i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at
'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation
(happened when AddressCount was > 1)
if( p_net_addr_oid->AddressLength !=
NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d
OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "
"should be %d\n", port_num, i,
p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength ==
NETWORK_ADDRESS_LENGTH_IPX );
+ break;
}
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t
*)p_net_addr_oid +
+
FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+
p_net_addr_oid->AddressLength) ;
+ ASSERT( p_net_addr_oid->AddressType ==
NDIS_PROTOCOL_ID_TCP_IP );
+
p_ip_addr =
(PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
if( !cl_memcmp( &p_ip_addr->in_addr,
&p_addr_item->address.as_ulong, sizeof(ULONG) )
)
@@ -2273,36 +2270,37 @@
/* Now look for new addresses */
p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;
idx = 0;
- for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
p_net_addr_oid->AddressLength) )
+
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES -
Address %d is wrong type of 0x%.4X, "
- "should be 0x%.4X\n", port_num, i,
p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field
is valid;
+ // otherwise, it can lead to a memory violation (happened when
AddressCount was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES -
Address %d is wrong size of %d, "
"should be %d\n", port_num, i,
p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength ==
NETWORK_ADDRESS_LENGTH_IPX );
+ break;
+
}
-
+
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP
);
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+
FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+
p_net_addr_oid->AddressLength) ;
+
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
/* Size the vector as needed. */
if( cl_vector_get_size( &p_adapter->ip_vector ) <= idx )
cl_vector_set_size( &p_adapter->ip_vector, idx + 1 );
- p_addr_item = cl_vector_get_ptr( &p_adapter->ip_vector, idx );
+ p_addr_item = (net_address_item_t *) cl_vector_get_ptr(
&p_adapter->ip_vector, idx );
if( !cl_memcmp( &p_ip_addr->in_addr,
&p_addr_item->address.as_ulong,
sizeof(ULONG) ) )
{
Index:
B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
===================================================================
--- B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
(revision 6298)
+++ B:/users/xalex/MLNX_WinOF-2_1_2/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
(revision 6299)
@@ -3514,30 +3514,27 @@
cl_vector_get_ptr( &p_adapter->ip_vector, idx );
p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;
- for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
- p_net_addr_oid->AddressLength) )
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType !=
NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
- ("Port %d
OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "
- "should be 0x%.4X\n", port_num,
i, p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at
'AddressLength' field is valid;
+ // otherwise, it can lead to a memory violation
(happened when AddressCount was > 1)
if( p_net_addr_oid->AddressLength !=
NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d
OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "
"should be %d\n", port_num, i,
p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength ==
NETWORK_ADDRESS_LENGTH_IPX );
+ break;
}
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t
*)p_net_addr_oid +
+
FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+
p_net_addr_oid->AddressLength) ;
+ ASSERT( p_net_addr_oid->AddressType ==
NDIS_PROTOCOL_ID_TCP_IP );
+
p_ip_addr =
(PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
if( !cl_memcmp( &p_ip_addr->in_addr,
&p_addr_item->address.as_ulong, sizeof(ULONG) )
)
@@ -3577,29 +3574,30 @@
/* Now look for new addresses */
p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;
idx = 0;
- for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =
- (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
- FIELD_OFFSET(NETWORK_ADDRESS, Address) +
p_net_addr_oid->AddressLength) )
+
+ for( i = 0; i < p_net_addrs->AddressCount; ++i )
{
- if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )
- {
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
- ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES -
Address %d is wrong type of 0x%.4X, "
- "should be 0x%.4X\n", port_num, i,
p_net_addr_oid->AddressType,
- NDIS_PROTOCOL_ID_TCP_IP));
- continue;
- }
-
+ // Here we check that the data stored at 'AddressLength' field
is valid;
+ // otherwise, it can lead to a memory violation (happened when
AddressCount was > 1)
if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)
{
- IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,
+ IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,
("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES -
Address %d is wrong size of %d, "
"should be %d\n", port_num, i,
p_net_addr_oid->AddressLength,
NETWORK_ADDRESS_LENGTH_IP));
- continue;
+ ASSERT ( p_net_addr_oid->AddressLength ==
NETWORK_ADDRESS_LENGTH_IPX );
+ break;
+
}
-
+
+ ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP
);
+
+ p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +
+
FIELD_OFFSET(NETWORK_ADDRESS, Address) +
+
p_net_addr_oid->AddressLength) ;
+
+
p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;
/* Size the vector as needed. */
_______________________________________________
ofw mailing list
[email protected]
http://lists.openfabrics.org/cgi-bin/mailman/listinfo/ofw
