diff mbox series

RDMA/irdma: Fix potential NULL-ptr-dereference

Message ID 20230126185230.62464-1-n.zhandarovich@fintech.ru
State New
Headers
Series RDMA/irdma: Fix potential NULL-ptr-dereference |

Commit Message

Nikita Zhandarovich Jan. 26, 2023, 6:52 p.m. UTC 
  in_dev_get() can return NULL which will cause a failure once idev is
dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
check for NULL value in idev beforehand.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>

 drivers/infiniband/hw/irdma/cm.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Devale, Sindhu Jan. 27, 2023, 3:38 p.m. UTC | #1 
> -----Original Message-----
> From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> Sent: Thursday, January 26, 2023 12:53 PM
> To: Ismail, Mustafa <mustafa.ismail@intel.com>
> Cc: Nikita Zhandarovich <n.zhandarovich@fintech.ru>; Saleem, Shiraz
> <shiraz.saleem@intel.com>; Jason Gunthorpe <jgg@ziepe.ca>; Leon
> Romanovsky <leon@kernel.org>; linux-rdma@vger.kernel.org; linux-
> kernel@vger.kernel.org; lvc-project@linuxtesting.org
> Subject: [PATCH] RDMA/irdma: Fix potential NULL-ptr-dereference
> 
> in_dev_get() can return NULL which will cause a failure once idev is
> dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for
> NULL value in idev beforehand.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> 
>  drivers/infiniband/hw/irdma/cm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/irdma/cm.c
> b/drivers/infiniband/hw/irdma/cm.c
> index 7b086fe63a24..195aa9ea18b6 100644
> --- a/drivers/infiniband/hw/irdma/cm.c
> +++ b/drivers/infiniband/hw/irdma/cm.c
> @@ -1722,6 +1722,9 @@ static int irdma_add_mqh_4(struct irdma_device
> *iwdev,
>  			continue;
> 
>  		idev = in_dev_get(ip_dev);
> +		if (!idev)
> +			continue;
> +
>  		in_dev_for_each_ifa_rtnl(ifa, idev) {
>  			ibdev_dbg(&iwdev->ibdev,
>  				  "CM: Allocating child CM Listener
> forIP=%pI4, vlan_id=%d, MAC=%pM\n",

Change looks good. Thanks!

Reviewed-by: Sindhu Devale <sindhu.devale@intel.com>
Leon Romanovsky Jan. 29, 2023, 12:57 p.m. UTC | #2 
On Thu, 26 Jan 2023 10:52:30 -0800, Nikita Zhandarovich wrote:
> in_dev_get() can return NULL which will cause a failure once idev is
> dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
> check for NULL value in idev beforehand.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> 
> [...]

Applied, thanks!

[1/1] RDMA/irdma: Fix potential NULL-ptr-dereference
      https://git.kernel.org/rdma/rdma/c/5d9745cead1f12

Best regards,
diff mbox series

Patch

diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c
index 7b086fe63a24..195aa9ea18b6 100644
--- a/drivers/infiniband/hw/irdma/cm.c
+++ b/drivers/infiniband/hw/irdma/cm.c
@@ -1722,6 +1722,9 @@  static int irdma_add_mqh_4(struct irdma_device *iwdev,
 			continue;
 
 		idev = in_dev_get(ip_dev);
+		if (!idev)
+			continue;
+
 		in_dev_for_each_ifa_rtnl(ifa, idev) {
 			ibdev_dbg(&iwdev->ibdev,
 				  "CM: Allocating child CM Listener forIP=%pI4, vlan_id=%d, MAC=%pM\n",