| Message ID | Y+utb9JSKpgAeiWC@kili (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4ca446b127c568b59cb8d9748b6f70499624bb18 |
| Headers | show |
| Series | iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry() | expand |
On Tue, Feb 14, 2023 at 06:49:03PM +0300, Dan Carpenter wrote: > This condition needs to match the previous "if (epcp->state == LISTEN) {" > exactly to avoid a NULL dereference of either "listen_ep" or "ep". The > problem is that "epcp" has been re-assigned so just testing > "if (epcp->state == LISTEN) {" a second time is not sufficient. > > Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") > Signed-off-by: Dan Carpenter <error27@gmail.com> > --- > >From static analysis, not from testing. It's possible that the current > code works but this change makes it more Obviously Correct[tm]. > Oops. I accidentally sent this twice. Sorry! regards, dan carpenter
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c index ff645b955a08..fd22c85d35f4 100644 --- a/drivers/infiniband/hw/cxgb4/restrack.c +++ b/drivers/infiniband/hw/cxgb4/restrack.c @@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg, if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history)) goto err_cancel_table; - if (epcp->state == LISTEN) { + if (listen_ep) { if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid)) goto err_cancel_table; if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient. Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") Signed-off-by: Dan Carpenter <error27@gmail.com> --- From static analysis, not from testing. It's possible that the current code works but this change makes it more Obviously Correct[tm]. drivers/infiniband/hw/cxgb4/restrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)