[PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

Fix two potential NULL pointer dereferences in the ionic driver by
adding the missing NULL checks before dereferencing netdev pointers.

Kamal Heib (2):
  RDMA/ionic: Fix potential NULL pointer dereference in
    ionic_query_device
  RDMA/ionic: Fix potential NULL pointer dereference in
    ionic_create_ibdev

 drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

-- 
2.55.0

[PATCH rdma-rc 1/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_device

[Kamal Heib]

The function ionic_query_device() calls ib_device_get_netdev() without
checking the return value which could lead to NULL pointer dereference,
Fix it by checking the return value and return -ENODEV if the 'ndev' is
NULL.

Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality")
Signed-off-by: Kamal Heib <kheib@redhat.com>
---
 drivers/infiniband/hw/ionic/ionic_ibdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/ionic/ionic_ibdev.c b/drivers/infiniband/hw/ionic/ionic_ibdev.c
index b0449c75f893..8614546b2558 100644
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.c
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.c
@@ -32,6 +32,9 @@ static int ionic_query_device(struct ib_device *ibdev,
 		return err;
 
 	ndev = ib_device_get_netdev(ibdev, 1);
+	if (!ndev)
+		return -ENODEV;
+
 	addrconf_ifid_eui48((u8 *)&attr->sys_image_guid, ndev);
 	dev_put(ndev);
 	attr->max_mr_size = dev->lif_cfg.npts_per_lif * PAGE_SIZE / 2;
-- 
2.55.0

[PATCH rdma-rc 2/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_create_ibdev

[Kamal Heib]

The ionic_lif_netdev() function can return NULL if lif->netdev is not set,
but the caller in ionic_create_ibdev() was not checking for this before
dereferencing the returned pointer in addrconf_ifid_eui48().

Add a NULL check after calling ionic_lif_netdev() and return -ENODEV if
no netdev is available.

Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter")
Signed-off-by: Kamal Heib <kheib@redhat.com>
---
 drivers/infiniband/hw/ionic/ionic_ibdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/infiniband/hw/ionic/ionic_ibdev.c b/drivers/infiniband/hw/ionic/ionic_ibdev.c
index 8614546b2558..c738eb5be085 100644
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.c
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.c
@@ -348,6 +348,11 @@ static struct ionic_ibdev *ionic_create_ibdev(struct ionic_aux_dev *ionic_adev)
 	ibdev->num_comp_vectors = dev->lif_cfg.eq_count - 2;
 
 	ndev = ionic_lif_netdev(ionic_adev->lif);
+	if (!ndev) {
+		rc = -ENODEV;
+		goto err_admin;
+	}
+
 	addrconf_ifid_eui48((u8 *)&ibdev->node_guid, ndev);
 	rc = ib_device_set_netdev(ibdev, ndev, 1);
 	/* ionic_lif_netdev() returns ndev with refcount held */
-- 
2.55.0

Re: [PATCH rdma-rc 1/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_device

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 542 bytes --]

On Fri, Jul 10, 2026 at 3:34 AM Kamal Heib <kheib@redhat.com> wrote:
>
> The function ionic_query_device() calls ib_device_get_netdev() without
> checking the return value which could lead to NULL pointer dereference,
> Fix it by checking the return value and return -ENODEV if the 'ndev' is
> NULL.
>
> Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality")
> Signed-off-by: Kamal Heib <kheib@redhat.com>

Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>

-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH rdma-rc 2/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_create_ibdev

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

On Fri, Jul 10, 2026 at 3:35 AM Kamal Heib <kheib@redhat.com> wrote:
>
> The ionic_lif_netdev() function can return NULL if lif->netdev is not set,
> but the caller in ionic_create_ibdev() was not checking for this before
> dereferencing the returned pointer in addrconf_ifid_eui48().
>
> Add a NULL check after calling ionic_lif_netdev() and return -ENODEV if
> no netdev is available.
>
> Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter")
> Signed-off-by: Kamal Heib <kheib@redhat.com>

Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>


-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Leon Romanovsky]

On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> Fix two potential NULL pointer dereferences in the ionic driver by
> adding the missing NULL checks before dereferencing netdev pointers.

How is it possible to have ionic IB driver without netdev?

Thanks

> 
> Kamal Heib (2):
>   RDMA/ionic: Fix potential NULL pointer dereference in
>     ionic_query_device
>   RDMA/ionic: Fix potential NULL pointer dereference in
>     ionic_create_ibdev
> 
>  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> -- 
> 2.55.0
> 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > Fix two potential NULL pointer dereferences in the ionic driver by
> > adding the missing NULL checks before dereferencing netdev pointers.
> 
> How is it possible to have ionic IB driver without netdev?
> 
> Thanks
>

Thanks for your review, after taking a deeper look:

For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
netdev via netdev_priv() and they are allocated/freed together,
lif->netdev cannot be NULL if lif is valid, Please drop this patch.

For Patch 1 (ionic_query_device): This one should remain.
ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
multiple code paths:

- Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
- No port_data: if (!ib_dev->port_data) return NULL;
- NULL netdev pointer stored in port_data

Also, the return value from ib_device_get_netdev() is being checked in
multiple places in both drivers and the RDMA core.

Let me know what you think?

Thanks,
Kamal

> > 
> > Kamal Heib (2):
> >   RDMA/ionic: Fix potential NULL pointer dereference in
> >     ionic_query_device
> >   RDMA/ionic: Fix potential NULL pointer dereference in
> >     ionic_create_ibdev
> > 
> >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> > 
> > -- 
> > 2.55.0
> > 
> > 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Leon Romanovsky]

On Sun, Jul 12, 2026 at 03:30:09PM -0400, Kamal Heib wrote:
> On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> > On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > > Fix two potential NULL pointer dereferences in the ionic driver by
> > > adding the missing NULL checks before dereferencing netdev pointers.
> > 
> > How is it possible to have ionic IB driver without netdev?
> > 
> > Thanks
> >
> 
> Thanks for your review, after taking a deeper look:
> 
> For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
> netdev via netdev_priv() and they are allocated/freed together,
> lif->netdev cannot be NULL if lif is valid, Please drop this patch.
> 
> For Patch 1 (ionic_query_device): This one should remain.
> ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
> multiple code paths:
> 
> - Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
> - No port_data: if (!ib_dev->port_data) return NULL;
> - NULL netdev pointer stored in port_data
> 
> Also, the return value from ib_device_get_netdev() is being checked in
> multiple places in both drivers and the RDMA core.
> 
> Let me know what you think?

I think that you shouldn't copy/paste answers from your favorite AI tool.

Thanks

> 
> Thanks,
> Kamal
> 
> > > 
> > > Kamal Heib (2):
> > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > >     ionic_query_device
> > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > >     ionic_create_ibdev
> > > 
> > >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> > >  1 file changed, 8 insertions(+)
> > > 
> > > -- 
> > > 2.55.0
> > > 
> > > 
> > 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

On Mon, Jul 13, 2026 at 12:17:33PM +0300, Leon Romanovsky wrote:
> On Sun, Jul 12, 2026 at 03:30:09PM -0400, Kamal Heib wrote:
> > On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> > > On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > > > Fix two potential NULL pointer dereferences in the ionic driver by
> > > > adding the missing NULL checks before dereferencing netdev pointers.
> > > 
> > > How is it possible to have ionic IB driver without netdev?
> > > 
> > > Thanks
> > >
> > 
> > Thanks for your review, after taking a deeper look:
> > 
> > For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
> > netdev via netdev_priv() and they are allocated/freed together,
> > lif->netdev cannot be NULL if lif is valid, Please drop this patch.
> > 
> > For Patch 1 (ionic_query_device): This one should remain.
> > ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
> > multiple code paths:
> > 
> > - Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
> > - No port_data: if (!ib_dev->port_data) return NULL;
> > - NULL netdev pointer stored in port_data
> > 
> > Also, the return value from ib_device_get_netdev() is being checked in
> > multiple places in both drivers and the RDMA core.
> > 
> > Let me know what you think?
> 
> I think that you shouldn't copy/paste answers from your favorite AI tool.
> 
> Thanks
>

With all due respect..., Your response is not contributing to the
discussion about the patch, if you don't like the change or you think
that it is not justified, you can say so.

> > 
> > Thanks,
> > Kamal
> > 
> > > > 
> > > > Kamal Heib (2):
> > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > >     ionic_query_device
> > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > >     ionic_create_ibdev
> > > > 
> > > >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> > > >  1 file changed, 8 insertions(+)
> > > > 
> > > > -- 
> > > > 2.55.0
> > > > 
> > > > 
> > > 
> > 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Leon Romanovsky]

On Mon, Jul 13, 2026 at 07:12:08AM -0400, Kamal Heib wrote:
> On Mon, Jul 13, 2026 at 12:17:33PM +0300, Leon Romanovsky wrote:
> > On Sun, Jul 12, 2026 at 03:30:09PM -0400, Kamal Heib wrote:
> > > On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> > > > On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > > > > Fix two potential NULL pointer dereferences in the ionic driver by
> > > > > adding the missing NULL checks before dereferencing netdev pointers.
> > > > 
> > > > How is it possible to have ionic IB driver without netdev?
> > > > 
> > > > Thanks
> > > >
> > > 
> > > Thanks for your review, after taking a deeper look:
> > > 
> > > For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
> > > netdev via netdev_priv() and they are allocated/freed together,
> > > lif->netdev cannot be NULL if lif is valid, Please drop this patch.
> > > 
> > > For Patch 1 (ionic_query_device): This one should remain.
> > > ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
> > > multiple code paths:
> > > 
> > > - Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
> > > - No port_data: if (!ib_dev->port_data) return NULL;
> > > - NULL netdev pointer stored in port_data
> > > 
> > > Also, the return value from ib_device_get_netdev() is being checked in
> > > multiple places in both drivers and the RDMA core.
> > > 
> > > Let me know what you think?
> > 
> > I think that you shouldn't copy/paste answers from your favorite AI tool.
> > 
> > Thanks
> >
> 
> With all due respect..., Your response is not contributing to the
> discussion about the patch, if you don't like the change or you think
> that it is not justified, you can say so.

Kamal,

You pasted a response from Claude/Codex while at the same time, you are expecting
me to spend time and effort explaining why all of it does not apply to the current
code.

Thanks

> 
> > > 
> > > Thanks,
> > > Kamal
> > > 
> > > > > 
> > > > > Kamal Heib (2):
> > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > >     ionic_query_device
> > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > >     ionic_create_ibdev
> > > > > 
> > > > >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> > > > >  1 file changed, 8 insertions(+)
> > > > > 
> > > > > -- 
> > > > > 2.55.0
> > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

On Mon, Jul 13, 2026 at 02:35:21PM +0300, Leon Romanovsky wrote:
> On Mon, Jul 13, 2026 at 07:12:08AM -0400, Kamal Heib wrote:
> > On Mon, Jul 13, 2026 at 12:17:33PM +0300, Leon Romanovsky wrote:
> > > On Sun, Jul 12, 2026 at 03:30:09PM -0400, Kamal Heib wrote:
> > > > On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> > > > > On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > > > > > Fix two potential NULL pointer dereferences in the ionic driver by
> > > > > > adding the missing NULL checks before dereferencing netdev pointers.
> > > > > 
> > > > > How is it possible to have ionic IB driver without netdev?
> > > > > 
> > > > > Thanks
> > > > >
> > > > 
> > > > Thanks for your review, after taking a deeper look:
> > > > 
> > > > For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
> > > > netdev via netdev_priv() and they are allocated/freed together,
> > > > lif->netdev cannot be NULL if lif is valid, Please drop this patch.
> > > > 
> > > > For Patch 1 (ionic_query_device): This one should remain.
> > > > ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
> > > > multiple code paths:
> > > > 
> > > > - Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
> > > > - No port_data: if (!ib_dev->port_data) return NULL;
> > > > - NULL netdev pointer stored in port_data
> > > > 
> > > > Also, the return value from ib_device_get_netdev() is being checked in
> > > > multiple places in both drivers and the RDMA core.
> > > > 
> > > > Let me know what you think?
> > > 
> > > I think that you shouldn't copy/paste answers from your favorite AI tool.
> > > 
> > > Thanks
> > >
> > 
> > With all due respect..., Your response is not contributing to the
> > discussion about the patch, if you don't like the change or you think
> > that it is not justified, you can say so.
> 
> Kamal,
> 
> You pasted a response from Claude/Codex while at the same time, you are expecting
> me to spend time and effort explaining why all of it does not apply to the current
> code.
>

Lean,

AI is havely used in multiple kernel development areas including RDMA.
Also, I think you should already know that from the company that you
work for...

Many respected kernel developers already using AI as productivity tool,
Judging a patch based on whether AI may have used or not is not a
valid argument, again if you don't like the change or you think it is
not justified, you can say so.


> Thanks
> 
> > 
> > > > 
> > > > Thanks,
> > > > Kamal
> > > > 
> > > > > > 
> > > > > > Kamal Heib (2):
> > > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > > >     ionic_query_device
> > > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > > >     ionic_create_ibdev
> > > > > > 
> > > > > >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> > > > > >  1 file changed, 8 insertions(+)
> > > > > > 
> > > > > > -- 
> > > > > > 2.55.0
> > > > > > 
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Jason Gunthorpe]

On Mon, Jul 13, 2026 at 08:41:03AM -0400, Kamal Heib wrote:

> Many respected kernel developers already using AI as productivity tool,
> Judging a patch based on whether AI may have used or not is not a
> valid argument, again if you don't like the change or you think it is
> not justified, you can say so.

Do not copy and paste email prose from a chatbot into and pretend like
you wrote it and did the thinking. If I want to talk to a chatbot I
have access to every one available here and don't need someone else to
sit in the middle.

If you are going to use AI as a productivity tool then you are still
expected to critically review anything it gives out before sticking it
into an email, and I vasly prefer to see something like "I used XYZ to
research this and it said Blah and I think it is right" before cut and
pasting AI.

Jason

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Leon Romanovsky]

On Mon, Jul 13, 2026 at 08:41:03AM -0400, Kamal Heib wrote:
> On Mon, Jul 13, 2026 at 02:35:21PM +0300, Leon Romanovsky wrote:
> > On Mon, Jul 13, 2026 at 07:12:08AM -0400, Kamal Heib wrote:
> > > On Mon, Jul 13, 2026 at 12:17:33PM +0300, Leon Romanovsky wrote:
> > > > On Sun, Jul 12, 2026 at 03:30:09PM -0400, Kamal Heib wrote:
> > > > > On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> > > > > > On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > > > > > > Fix two potential NULL pointer dereferences in the ionic driver by
> > > > > > > adding the missing NULL checks before dereferencing netdev pointers.
> > > > > > 
> > > > > > How is it possible to have ionic IB driver without netdev?
> > > > > > 
> > > > > > Thanks
> > > > > >
> > > > > 
> > > > > Thanks for your review, after taking a deeper look:
> > > > > 
> > > > > For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
> > > > > netdev via netdev_priv() and they are allocated/freed together,
> > > > > lif->netdev cannot be NULL if lif is valid, Please drop this patch.
> > > > > 
> > > > > For Patch 1 (ionic_query_device): This one should remain.
> > > > > ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
> > > > > multiple code paths:
> > > > > 
> > > > > - Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
> > > > > - No port_data: if (!ib_dev->port_data) return NULL;
> > > > > - NULL netdev pointer stored in port_data
> > > > > 
> > > > > Also, the return value from ib_device_get_netdev() is being checked in
> > > > > multiple places in both drivers and the RDMA core.
> > > > > 
> > > > > Let me know what you think?
> > > > 
> > > > I think that you shouldn't copy/paste answers from your favorite AI tool.
> > > > 
> > > > Thanks
> > > >
> > > 
> > > With all due respect..., Your response is not contributing to the
> > > discussion about the patch, if you don't like the change or you think
> > > that it is not justified, you can say so.
> > 
> > Kamal,
> > 
> > You pasted a response from Claude/Codex while at the same time, you are expecting
> > me to spend time and effort explaining why all of it does not apply to the current
> > code.
> >
> 
> Lean,
> 
> AI is havely used in multiple kernel development areas including RDMA.
> Also, I think you should already know that from the company that you
> work for...
> 
> Many respected kernel developers already using AI as productivity tool,
> Judging a patch based on whether AI may have used or not is not a
> valid argument, again if you don't like the change or you think it is
> not justified, you can say so.

Like Jason wrote, we have no issue with patches developed with the
assistance of AI. We do, however, object to AI-generated emails and
replies.

Thanks

> 
> 
> > Thanks
> > 
> > > 
> > > > > 
> > > > > Thanks,
> > > > > Kamal
> > > > > 
> > > > > > > 
> > > > > > > Kamal Heib (2):
> > > > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > > > >     ionic_query_device
> > > > > > >   RDMA/ionic: Fix potential NULL pointer dereference in
> > > > > > >     ionic_create_ibdev
> > > > > > > 
> > > > > > >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> > > > > > >  1 file changed, 8 insertions(+)
> > > > > > > 
> > > > > > > -- 
> > > > > > > 2.55.0
> > > > > > > 
> > > > > > > 
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
>