[PATCH rdma-next] RDMA/cxgb4: Protect from possible dereference

[PATCH rdma-next] RDMA/cxgb4: Protect from possible dereference

[Leon Romanovsky]

Smatch tool reports the following error:
  drivers/infiniband/hw/cxgb4/qp.c:1886
	c4iw_create_qp() error: we previously assumed 'ucontext'
	could be null (see line 1804)

Cc: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>
Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
 drivers/infiniband/hw/cxgb4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 57b23e33eb8b..4b3267358dff 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 	if (ret)
 		goto err_destroy_qp;

-	if (udata) {
+	if (udata && ucontext) {
 		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
 		if (!sq_key_mm) {
 			ret = -ENOMEM;
--
2.14.2

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: [PATCH rdma-next] RDMA/cxgb4: Protect from possible dereference

[Steve Wise]

> 
> Smatch tool reports the following error:
>   drivers/infiniband/hw/cxgb4/qp.c:1886
> 	c4iw_create_qp() error: we previously assumed 'ucontext'
> 	could be null (see line 1804)
> 
> Cc: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>
> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
> ---
>  drivers/infiniband/hw/cxgb4/qp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/cxgb4/qp.c
> b/drivers/infiniband/hw/cxgb4/qp.c
> index 57b23e33eb8b..4b3267358dff 100644
> --- a/drivers/infiniband/hw/cxgb4/qp.c
> +++ b/drivers/infiniband/hw/cxgb4/qp.c
> @@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
> struct ib_qp_init_attr *attrs,
>  	if (ret)
>  		goto err_destroy_qp;
> 
> -	if (udata) {
> +	if (udata && ucontext) {
>  		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
>  		if (!sq_key_mm) {
>  			ret = -ENOMEM;


Hey Leon, doesn't udata imply ucontext?   It's not a big deal, though, I
guess.

Reviewed-by: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>


--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH rdma-next] RDMA/cxgb4: Protect from possible dereference

[Leon Romanovsky]

[-- Attachment #1: Type: text/plain, Size: 1647 bytes --]

On Sun, Oct 29, 2017 at 04:29:50PM -0500, Steve Wise wrote:
> >
> > Smatch tool reports the following error:
> >   drivers/infiniband/hw/cxgb4/qp.c:1886
> > 	c4iw_create_qp() error: we previously assumed 'ucontext'
> > 	could be null (see line 1804)
> >
> > Cc: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>
> > Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
> > ---
> >  drivers/infiniband/hw/cxgb4/qp.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/hw/cxgb4/qp.c
> > b/drivers/infiniband/hw/cxgb4/qp.c
> > index 57b23e33eb8b..4b3267358dff 100644
> > --- a/drivers/infiniband/hw/cxgb4/qp.c
> > +++ b/drivers/infiniband/hw/cxgb4/qp.c
> > @@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
> > struct ib_qp_init_attr *attrs,
> >  	if (ret)
> >  		goto err_destroy_qp;
> >
> > -	if (udata) {
> > +	if (udata && ucontext) {
> >  		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
> >  		if (!sq_key_mm) {
> >  			ret = -ENOMEM;
>
>
> Hey Leon, doesn't udata imply ucontext?   It's not a big deal, though, I
> guess.

Yes, it is, but I don't see any other option to clean RDMA.

➜  linux-rdma git:(rdma-next) x checks
Preparing /tmp/tmp.rkPKPYnNE2 (identifier tmp.rkPKPYnNE2)
Checking out files: 100% (61292/61292), done.
HEAD is now at e183225dff87 RDMA/cxgb4: Protect from possible dereference
Redirecting the output to /tmp/tmp.VZsidBz0jJ
There are 387 errors/warnings

>
> Reviewed-by: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>
>

Thanks

>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH rdma-next] RDMA/cxgb4: Protect from possible dereference

[Doug Ledford]

[-- Attachment #1: Type: text/plain, Size: 613 bytes --]

On Sun, 2017-10-29 at 21:34 +0200, Leon Romanovsky wrote:
> Smatch tool reports the following error:
>   drivers/infiniband/hw/cxgb4/qp.c:1886
>         c4iw_create_qp() error: we previously assumed 'ucontext'
>         could be null (see line 1804)
> 
> Cc: Steve Wise <swise-7bPotxP6k4+P2YhJcF5u+vpXobYPEAuW@public.gmane.org>
> Signed-off-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>

Thanks, applied.

-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]