rdma/sys.c: fix possible out-of-bound array access

[mirror_iproute2.git] / rdma / res.c

diff --git a/rdma/res.c b/rdma/res.c
index 140c0908ee6fa9e10206200fa9c6303ff1947746..6003006e98aa43ca32a481240d541f84bbf9c809 100644 (file)
--- a/rdma/res.c
+++ b/rdma/res.c
@@ -47,11 +47,18 @@ static int res_print_summary(struct rd *rd, struct nlattr **tb)
 
                name = mnl_attr_get_str(nla_line[RDMA_NLDEV_ATTR_RES_SUMMARY_ENTRY_NAME]);
                curr = mnl_attr_get_u64(nla_line[RDMA_NLDEV_ATTR_RES_SUMMARY_ENTRY_CURR]);
-               res_print_uint(rd, name, curr);
+               res_print_uint(
+                       rd, name, curr,
+                       nla_line[RDMA_NLDEV_ATTR_RES_SUMMARY_ENTRY_CURR]);
        }
        return 0;
 }
 
+static int res_no_args_idx_parse_cb(const struct nlmsghdr *nlh, void *data)
+{
+       return MNL_CB_OK;
+}
+
 static int res_no_args_parse_cb(const struct nlmsghdr *nlh, void *data)
 {
        struct nlattr *tb[RDMA_NLDEV_ATTR_MAX] = {};
@@ -81,6 +88,33 @@ static int res_no_args_parse_cb(const struct nlmsghdr *nlh, void *data)
        return MNL_CB_OK;
 }
 
+int _res_send_idx_msg(struct rd *rd, uint32_t command, mnl_cb_t callback,
+                     uint32_t idx, uint32_t id)
+{
+       uint32_t flags = NLM_F_REQUEST | NLM_F_ACK;
+       uint32_t seq;
+       int ret;
+
+       rd_prepare_msg(rd, command, &seq, flags);
+       mnl_attr_put_u32(rd->nlh, RDMA_NLDEV_ATTR_DEV_INDEX, rd->dev_idx);
+       if (rd->port_idx)
+               mnl_attr_put_u32(rd->nlh,
+                                RDMA_NLDEV_ATTR_PORT_INDEX, rd->port_idx);
+
+       mnl_attr_put_u32(rd->nlh, id, idx);
+
+       ret = rd_send_msg(rd);
+       if (ret)
+               return ret;
+
+       if (rd->json_output)
+               jsonw_start_object(rd->jw);
+       ret = rd_recv_msg(rd, callback, rd, seq);
+       if (rd->json_output)
+               jsonw_end_object(rd->jw);
+       return ret;
+}
+
 int _res_send_msg(struct rd *rd, uint32_t command, mnl_cb_t callback)
 {
        uint32_t flags = NLM_F_REQUEST | NLM_F_ACK;
@@ -114,9 +148,11 @@ const char *qp_types_to_str(uint8_t idx)
                                                     "UC", "UD", "RAW_IPV6",
                                                     "RAW_ETHERTYPE",
                                                     "UNKNOWN", "RAW_PACKET",
-                                                    "XRC_INI", "XRC_TGT" };
+                                                    "XRC_INI", "XRC_TGT",
+                                                    [0xFF] = "DRIVER",
+       };
 
-       if (idx < ARRAY_SIZE(qp_types_str))
+       if (idx < ARRAY_SIZE(qp_types_str) && qp_types_str[idx])
                return qp_types_str[idx];
        return "UNKNOWN";
 }
@@ -125,6 +161,9 @@ void print_comm(struct rd *rd, const char *str, struct nlattr **nla_line)
 {
        char tmp[18];
 
+       if (!str)
+               return;
+
        if (rd->json_output) {
                /* Don't beatify output in JSON format */
                jsonw_string_field(rd->jw, "comm", str);
@@ -188,23 +227,31 @@ char *get_task_name(uint32_t pid)
        return comm;
 }
 
-void print_key(struct rd *rd, const char *name, uint64_t val)
+void print_key(struct rd *rd, const char *name, uint64_t val,
+              struct nlattr *nlattr)
 {
+       if (!nlattr)
+               return;
+
        if (rd->json_output)
                jsonw_xint_field(rd->jw, name, val);
        else
                pr_out("%s 0x%" PRIx64 " ", name, val);
 }
 
-void res_print_uint(struct rd *rd, const char *name, uint64_t val)
+void res_print_uint(struct rd *rd, const char *name, uint64_t val,
+                   struct nlattr *nlattr)
 {
+       if (!nlattr)
+               return;
+
        if (rd->json_output)
                jsonw_u64_field(rd->jw, name, val);
        else
                pr_out("%s %" PRIu64 " ", name, val);
 }
 
-RES_FUNC(res_no_args,  RDMA_NLDEV_CMD_RES_GET, NULL, true);
+RES_FUNC(res_no_args,  RDMA_NLDEV_CMD_RES_GET, NULL, true, 0);
 
 static int res_show(struct rd *rd)
 {