diff mbox

librdmacm: Avoid crash if rdma_disconnect() is called incorrectly

Message ID 1525710444-17943-1-git-send-email-andrew.boyer@dell.com (mailing list archive)
State Accepted
Delegated to: Jason Gunthorpe
Headers show

Commit Message

Andrew Boyer May 7, 2018, 4:27 p.m. UTC
If the cm_id is not connected, id->verbs will be NULL. Check the
pointer before dereferencing it.

Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
---
 librdmacm/cma.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Jason Gunthorpe May 16, 2018, 6:05 p.m. UTC | #1
On Mon, May 07, 2018 at 12:27:24PM -0400, Andrew Boyer wrote:
> If the cm_id is not connected, id->verbs will be NULL. Check the
> pointer before dereferencing it.
> 
> Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
> ---
>  librdmacm/cma.c | 3 +++
>  1 file changed, 3 insertions(+)

applied thanks.. I wonder if there are more cases like this?

Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/librdmacm/cma.c b/librdmacm/cma.c
index fa37065..2b36e89 100644
--- a/librdmacm/cma.c
+++ b/librdmacm/cma.c
@@ -1684,6 +1684,9 @@  int rdma_notify(struct rdma_cm_id *id, enum ibv_event_type event)
 
 int ucma_shutdown(struct rdma_cm_id *id)
 {
+	if (!id->verbs || !id->verbs->device)
+		return ERR(EINVAL);
+
 	switch (id->verbs->device->transport_type) {
 	case IBV_TRANSPORT_IB:
 		return ucma_modify_qp_err(id);