| Message ID | 20230202184850.29882-1-n.zhandarovich@fintech.ru (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [v2] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() | expand |
On Thu, Feb 02, 2023 at 10:48:50AM -0800, Nikita Zhandarovich wrote: > If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is > dereferenced later regardless of whether it is empty. > This patch adds a simple sanity check to fix the issue. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") > Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> > --- > v2: do not use pr_warn() when get_ep_from_tid() returns NULL as > Jason Gunthorpe <jgg@ziepe.ca> suggested. > > drivers/infiniband/hw/cxgb4/cm.c | 2 ++ > 1 file changed, 2 insertions(+) I applied, but please next time. 1. Don't send patches as reply-to. It messes whole patch flow. 2. Use target in subject line, e.g. [PATCH rdma-next] or [PATCH rdma-rc] Thanks > > diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c > index 499a425a3379..f5f4579f037c 100644 > --- a/drivers/infiniband/hw/cxgb4/cm.c > +++ b/drivers/infiniband/hw/cxgb4/cm.c > @@ -2676,6 +2676,8 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb) > u16 tcp_opt = ntohs(req->tcp_opt); > > ep = get_ep_from_tid(dev, tid); > + if (!ep) > + return 0; > pr_debug("ep %p tid %u\n", ep, ep->hwtid); > ep->snd_seq = be32_to_cpu(req->snd_isn); > ep->rcv_seq = be32_to_cpu(req->rcv_isn); > -- > 2.25.1 >
On Thu, 02 Feb 2023 10:48:50 -0800, Nikita Zhandarovich wrote: > If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is > dereferenced later regardless of whether it is empty. > This patch adds a simple sanity check to fix the issue. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > > [...] Applied, thanks! [1/1] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() https://git.kernel.org/rdma/rdma/c/283861a4c52c1e Best regards,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index 499a425a3379..f5f4579f037c 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -2676,6 +2676,8 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb) u16 tcp_opt = ntohs(req->tcp_opt); ep = get_ep_from_tid(dev, tid); + if (!ep) + return 0; pr_debug("ep %p tid %u\n", ep, ep->hwtid); ep->snd_seq = be32_to_cpu(req->snd_isn); ep->rcv_seq = be32_to_cpu(req->rcv_isn);
If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is dereferenced later regardless of whether it is empty. This patch adds a simple sanity check to fix the issue. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> --- v2: do not use pr_warn() when get_ep_from_tid() returns NULL as Jason Gunthorpe <jgg@ziepe.ca> suggested. drivers/infiniband/hw/cxgb4/cm.c | 2 ++ 1 file changed, 2 insertions(+)