| Message ID | da822315-02b7-4f5b-9c86-0d5176c5069d@stanley.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | be461814aa4cb32aae061404b9a6a83ef3895018 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net/mlx5: HWS, check the correct variable in hws_send_ring_alloc_sq() | expand |
On Sat, Sep 14, 2024 at 12:58:26PM +0300, Dan Carpenter wrote: > There is a copy and paste bug so this code checks "sq->dep_wqe" where > "sq->wr_priv" was intended. It could result in a NULL pointer > dereference. > > Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org>
Hello: This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <kuba@kernel.org>: On Sat, 14 Sep 2024 12:58:26 +0300 you wrote: > There is a copy and paste bug so this code checks "sq->dep_wqe" where > "sq->wr_priv" was intended. It could result in a NULL pointer > dereference. > > Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > [...] Here is the summary with links: - [net-next] net/mlx5: HWS, check the correct variable in hws_send_ring_alloc_sq() https://git.kernel.org/netdev/net-next/c/be461814aa4c You are awesome, thank you!
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c index fb97a15c041a..a1adbb48735c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c @@ -584,7 +584,7 @@ static int hws_send_ring_alloc_sq(struct mlx5_core_dev *mdev, } sq->wr_priv = kzalloc(sizeof(*sq->wr_priv) * buf_sz, GFP_KERNEL); - if (!sq->dep_wqe) { + if (!sq->wr_priv) { err = -ENOMEM; goto free_dep_wqe; }
There is a copy and paste bug so this code checks "sq->dep_wqe" where "sq->wr_priv" was intended. It could result in a NULL pointer dereference. Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- .../net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)