[IPOIB,IPOIB_NDIS6_CM]

Fixing the bug when NDIS sends OID_GEN_NETWORK_LAYER_ADDRESSES with the list of new addresses with invalid formatting (happened when AddressCount =5)

NDIS sends NETWORK_ADDRESS_LIST structure, which contains an array of NETWORK_ADDRESS structures of variable size. The calculation of the next address offset is based on AddressLength;  in a case when this field contains wrong data, one can get access violation error

Signed-off by: Alexander Naslednikov (xalex at mellanox.co.il)

git-svn-id: svn://openib.tc.cornell.edu/gen1@2876 ad392aa1-c5ef-ae45-8dd8-e69d62a5ef86

diff --git a/trunk/ulp/ipoib/kernel/ipoib_driver.c b/trunk/ulp/ipoib/kernel/ipoib_driver.c
index a29347e09a3b3113faebb1dab45967c521dcde00..5a27df6588e883369ac1f0b25c90209c32fb8494 100644 (file)
--- a/trunk/ulp/ipoib/kernel/ipoib_driver.c
+++ b/trunk/ulp/ipoib/kernel/ipoib_driver.c
@@ -2203,30 +2203,29 @@ __ipoib_set_net_addr(
                        cl_vector_get_ptr( &p_adapter->ip_vector, idx );\r
                p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;\r
 \r
-               for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =\r
-                       (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
-                       FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
-                       p_net_addr_oid->AddressLength) )\r
+               for( i = 0; i < p_net_addrs->AddressCount; ++i )\r
                {\r
 \r
-                       if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )\r
-                       {\r
-                               IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,\r
-                                       ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "\r
-                                               "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,\r
-                                               NDIS_PROTOCOL_ID_TCP_IP));\r
-                               continue;\r
-                       }\r
-\r
+                       // Here we check that the data stored at 'AddressLength' field is valid;\r
+                       // otherwise, it can lead to a memory violation (happened when AddressCount was > 1)\r
                        if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)\r
                        {\r
-                               IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,\r
+                               IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,\r
                                        ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "\r
                                                "should be %d\n", port_num, i, p_net_addr_oid->AddressLength,\r
                                                NETWORK_ADDRESS_LENGTH_IP));\r
-                               continue;\r
+                               ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );\r
+                               break;\r
                        }\r
 \r
+                       ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );\r
+                       \r
+                       p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
+                                                               FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
+                                                               p_net_addr_oid->AddressLength) ;\r
+\r
+                       \r
+\r
                        p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;\r
                        if( !cl_memcmp( &p_ip_addr->in_addr,\r
                                &p_addr_item->address.as_ulong, sizeof(ULONG) ) )\r
@@ -2266,36 +2265,37 @@ __ipoib_set_net_addr(
        /* Now look for new addresses */\r
        p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;\r
        idx = 0;\r
-       for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =\r
-               (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
-               FIELD_OFFSET(NETWORK_ADDRESS, Address) + p_net_addr_oid->AddressLength) )\r
+       \r
+       for( i = 0; i < p_net_addrs->AddressCount; ++i )\r
        {\r
 \r
-               if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )\r
-               {\r
-                       IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,\r
-                               ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "\r
-                                       "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,\r
-                                       NDIS_PROTOCOL_ID_TCP_IP));\r
-                       continue;\r
-               }\r
-\r
+               // Here we check that the data stored at 'AddressLength' field is valid;\r
+               // otherwise, it can lead to a memory violation (happened when AddressCount was > 1)\r
                if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)\r
                {\r
-                       IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,\r
+                       IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,\r
                                ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "\r
                                        "should be %d\n", port_num, i, p_net_addr_oid->AddressLength,\r
                                        NETWORK_ADDRESS_LENGTH_IP));\r
-                       continue;\r
+                       ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );\r
+                       break;\r
+                       \r
                }\r
-\r
+               \r
+               ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );\r
+               \r
+               p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
+                                                       FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
+                                                       p_net_addr_oid->AddressLength) ;\r
+               \r
+               \r
                p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;\r
 \r
                /* Size the vector as needed. */\r
                if( cl_vector_get_size( &p_adapter->ip_vector ) <= idx )\r
                        cl_vector_set_size( &p_adapter->ip_vector, idx + 1 );\r
 \r
-               p_addr_item = cl_vector_get_ptr( &p_adapter->ip_vector, idx );\r
+               p_addr_item = (net_address_item_t *) cl_vector_get_ptr( &p_adapter->ip_vector, idx );\r
                if( !cl_memcmp( &p_ip_addr->in_addr, &p_addr_item->address.as_ulong,\r
                        sizeof(ULONG) ) )\r
                {\r

diff --git a/trunk/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp b/trunk/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
index 850b2d43d7b6b203370a60dbef1b7b9a9cddb376..c189e950e6218d46899c21c4ea7c14beb14ceb34 100644 (file)
--- a/trunk/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
+++ b/trunk/ulp/ipoib_NDIS6_CM/kernel/ipoib_driver.cpp
@@ -3553,29 +3553,27 @@ __ipoib_set_net_addr(
                        cl_vector_get_ptr( &p_adapter->ip_vector, idx );\r
                p_net_addr_oid = (PNETWORK_ADDRESS)p_net_addrs->Address;\r
 \r
-               for( i = 0; i < p_net_addrs->AddressCount; ++i, p_net_addr_oid =\r
-                       (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
-                       FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
-                       p_net_addr_oid->AddressLength) )\r
+               for( i = 0; i < p_net_addrs->AddressCount; ++i )\r
                {\r
 \r
-                       if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )\r
-                       {\r
-                               IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,\r
-                                       ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "\r
-                                               "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,\r
-                                               NDIS_PROTOCOL_ID_TCP_IP));\r
-                               continue;\r
-                       }\r
-\r
+                       // Here we check that the data stored at 'AddressLength' field is valid;\r
+                       // otherwise, it can lead to a memory violation (happened when AddressCount was > 1)\r
                        if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)\r
                        {\r
-                               IPOIB_PRINT( TRACE_LEVEL_WARNING, IPOIB_DBG_OID,\r
+                               IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,\r
                                        ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "\r
                                                "should be %d\n", port_num, i, p_net_addr_oid->AddressLength,\r
                                                NETWORK_ADDRESS_LENGTH_IP));\r
-                               continue;\r
+                               ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );\r
+                               break;\r
                        }\r
+                       \r
+                       ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );\r
+                       \r
+                       p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
+                                                               FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
+                                                               p_net_addr_oid->AddressLength) ;\r
+\r
 \r
                        p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;\r
                        if( !cl_memcmp( &p_ip_addr->in_addr,\r
@@ -3616,29 +3614,30 @@ __ipoib_set_net_addr(
        /* Now look for new addresses */\r
        p_net_addr_oid = (NETWORK_ADDRESS *)p_net_addrs->Address;\r
        idx = 0;\r
-       for( i = 0; i < p_net_addrs->AddressCount; i++, p_net_addr_oid =\r
-               (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
-               FIELD_OFFSET(NETWORK_ADDRESS, Address) + p_net_addr_oid->AddressLength) )\r
+       \r
+       for( i = 0; i < p_net_addrs->AddressCount; ++i )\r
        {\r
 \r
-               if( p_net_addr_oid->AddressType != NDIS_PROTOCOL_ID_TCP_IP )\r
-               {\r
-                       IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,\r
-                               ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong type of 0x%.4X, "\r
-                                       "should be 0x%.4X\n", port_num, i, p_net_addr_oid->AddressType,\r
-                                       NDIS_PROTOCOL_ID_TCP_IP));\r
-                       continue;\r
-               }\r
-\r
+               // Here we check that the data stored at 'AddressLength' field is valid;\r
+               // otherwise, it can lead to a memory violation (happened when AddressCount was > 1)\r
                if( p_net_addr_oid->AddressLength != NETWORK_ADDRESS_LENGTH_IP)\r
                {\r
-                       IPOIB_PRINT(TRACE_LEVEL_INFORMATION, IPOIB_DBG_OID,\r
+                       IPOIB_PRINT(TRACE_LEVEL_ERROR, IPOIB_DBG_ERROR,\r
                                ("Port %d OID_GEN_NETWORK_LAYER_ADDRESSES - Address %d is wrong size of %d, "\r
                                        "should be %d\n", port_num, i, p_net_addr_oid->AddressLength,\r
                                        NETWORK_ADDRESS_LENGTH_IP));\r
-                       continue;\r
+                       ASSERT ( p_net_addr_oid->AddressLength == NETWORK_ADDRESS_LENGTH_IPX );\r
+                       break;\r
+                       \r
                }\r
-\r
+               \r
+               ASSERT( p_net_addr_oid->AddressType == NDIS_PROTOCOL_ID_TCP_IP );\r
+               \r
+               p_net_addr_oid = (PNETWORK_ADDRESS)((uint8_t *)p_net_addr_oid +\r
+                                                       FIELD_OFFSET(NETWORK_ADDRESS, Address) +\r
+                                                       p_net_addr_oid->AddressLength) ;\r
+               \r
+               \r
                p_ip_addr = (PNETWORK_ADDRESS_IP)p_net_addr_oid->Address;\r
 \r
                /* Size the vector as needed. */\r