* [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user_ah()
@ 2025-11-12 7:45 Tuo Li
2025-11-12 11:30 ` Leon Romanovsky
0 siblings, 1 reply; 2+ messages in thread
From: Tuo Li @ 2025-11-12 7:45 UTC (permalink / raw)
To: krzysztof.czurylo, tatyana.e.nikolova, jgg, leon
Cc: linux-rdma, linux-kernel, Tuo Li
The variable udata is checked at the beginning of irdma_create_user_as(),
indicating that it can be NULL:
if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
return -EINVAL;
However, if udata is NULL, a null-pointer dereference may occur when
calling ib_copy_to_udata():
err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
To prevent this possible null-pointer dereference, add a NULL check for
udata before calling ib_copy_to_udata().
Signed-off-by: Tuo Li <islituo@gmail.com>
---
drivers/infiniband/hw/irdma/verbs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c883c9ea5a83..01eccbbb9600 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -5233,7 +5233,8 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
mutex_unlock(&iwdev->rf->ah_tbl_lock);
uresp.ah_id = ah->sc_ah.ah_info.ah_idx;
- err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
+ if (udata)
+ err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
if (err)
irdma_destroy_ah(ibah, attr->flags);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user_ah()
2025-11-12 7:45 [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user_ah() Tuo Li
@ 2025-11-12 11:30 ` Leon Romanovsky
0 siblings, 0 replies; 2+ messages in thread
From: Leon Romanovsky @ 2025-11-12 11:30 UTC (permalink / raw)
To: Tuo Li; +Cc: krzysztof.czurylo, tatyana.e.nikolova, jgg, linux-rdma,
linux-kernel
On Wed, Nov 12, 2025 at 03:45:12PM +0800, Tuo Li wrote:
> The variable udata is checked at the beginning of irdma_create_user_as(),
> indicating that it can be NULL:
>
> if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
> return -EINVAL;
Just delete "udata" check from this if(). irdma_create_user_ah() always
receives udate.
Thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-12 11:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-12 7:45 [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user_ah() Tuo Li
2025-11-12 11:30 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox