Re: [PATCH rdma-next] RDMA/irdma: Prevent user-triggered null deref on QP create

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Jun 17, 2026 at 04:40:13PM +0000, Jacob Moroni wrote:
> Previously, the user QP creation path would only attempt to
> populate iwqp->iwpbl if the user-provided req.user_wqe_bufs
> field was non-zero. The problem is that iwqp->iwpbl is
> unconditionally dereferenced later on in irdma_setup_virt_qp.
> 
> While there was a check for iwqp->iwpbl != NULL, this check
> would only occur if req.user_wqe_bufs was non-zero. The end
> result is that a user could send a zero user_wqe_bufs value
> and trigger a null ptr deref.
> 
> Fix this by unconditionally calling irdma_get_pbl and bailing
> if it fails, similar to the CQ and SRQ paths.
> 
> Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
> Signed-off-by: Jacob Moroni <jmoroni@google.com>
> Reviewed-by: David Hu <xuehaohu@google.com>
> ---
>  drivers/infiniband/hw/irdma/verbs.c | 21 ++++++++++-----------
>  1 file changed, 10 insertions(+), 11 deletions(-)

Applied to for-rc

Thanks,
Jason