IB/mad: Verify mgmt class in received MADs

If a received MAD contains an invalid or reserved mgmt class, we will
attempt to access method_table outside of its range.  Add a check to
ensure that mgmt class falls within the handled range.

Found by code inspection.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index b4d8672a3e4ef539481a4089cc25f8c7b8f38901..056389229ea7d03573e8dfa7b29520ed18a671fd 100644 (file)
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1596,6 +1596,9 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
                                        mad->mad_hdr.class_version].class;
                        if (!class)
                                goto out;
+                       if (convert_mgmt_class(mad->mad_hdr.mgmt_class) >=
+                           IB_MGMT_MAX_METHODS)
+                               goto out;
                        method = class->method_table[convert_mgmt_class(
                                                        mad->mad_hdr.mgmt_class)];
                        if (method)