[PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

Fix two potential NULL pointer dereferences in the ionic driver by
adding the missing NULL checks before dereferencing netdev pointers.

Kamal Heib (2):
  RDMA/ionic: Fix potential NULL pointer dereference in
    ionic_query_device
  RDMA/ionic: Fix potential NULL pointer dereference in
    ionic_create_ibdev

 drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

-- 
2.55.0

[PATCH rdma-rc 1/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_device

[Kamal Heib]

The function ionic_query_device() calls ib_device_get_netdev() without
checking the return value which could lead to NULL pointer dereference,
Fix it by checking the return value and return -ENODEV if the 'ndev' is
NULL.

Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality")
Signed-off-by: Kamal Heib <kheib@redhat.com>
---
 drivers/infiniband/hw/ionic/ionic_ibdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/ionic/ionic_ibdev.c b/drivers/infiniband/hw/ionic/ionic_ibdev.c
index b0449c75f893..8614546b2558 100644
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.c
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.c
@@ -32,6 +32,9 @@ static int ionic_query_device(struct ib_device *ibdev,
 		return err;
 
 	ndev = ib_device_get_netdev(ibdev, 1);
+	if (!ndev)
+		return -ENODEV;
+
 	addrconf_ifid_eui48((u8 *)&attr->sys_image_guid, ndev);
 	dev_put(ndev);
 	attr->max_mr_size = dev->lif_cfg.npts_per_lif * PAGE_SIZE / 2;
-- 
2.55.0

[PATCH rdma-rc 2/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_create_ibdev

[Kamal Heib]

The ionic_lif_netdev() function can return NULL if lif->netdev is not set,
but the caller in ionic_create_ibdev() was not checking for this before
dereferencing the returned pointer in addrconf_ifid_eui48().

Add a NULL check after calling ionic_lif_netdev() and return -ENODEV if
no netdev is available.

Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter")
Signed-off-by: Kamal Heib <kheib@redhat.com>
---
 drivers/infiniband/hw/ionic/ionic_ibdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/infiniband/hw/ionic/ionic_ibdev.c b/drivers/infiniband/hw/ionic/ionic_ibdev.c
index 8614546b2558..c738eb5be085 100644
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.c
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.c
@@ -348,6 +348,11 @@ static struct ionic_ibdev *ionic_create_ibdev(struct ionic_aux_dev *ionic_adev)
 	ibdev->num_comp_vectors = dev->lif_cfg.eq_count - 2;
 
 	ndev = ionic_lif_netdev(ionic_adev->lif);
+	if (!ndev) {
+		rc = -ENODEV;
+		goto err_admin;
+	}
+
 	addrconf_ifid_eui48((u8 *)&ibdev->node_guid, ndev);
 	rc = ib_device_set_netdev(ibdev, ndev, 1);
 	/* ionic_lif_netdev() returns ndev with refcount held */
-- 
2.55.0

Re: [PATCH rdma-rc 1/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_device

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 542 bytes --]

On Fri, Jul 10, 2026 at 3:34 AM Kamal Heib <kheib@redhat.com> wrote:
>
> The function ionic_query_device() calls ib_device_get_netdev() without
> checking the return value which could lead to NULL pointer dereference,
> Fix it by checking the return value and return -ENODEV if the 'ndev' is
> NULL.
>
> Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality")
> Signed-off-by: Kamal Heib <kheib@redhat.com>

Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>

-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH rdma-rc 2/2] RDMA/ionic: Fix potential NULL pointer dereference in ionic_create_ibdev

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

On Fri, Jul 10, 2026 at 3:35 AM Kamal Heib <kheib@redhat.com> wrote:
>
> The ionic_lif_netdev() function can return NULL if lif->netdev is not set,
> but the caller in ionic_create_ibdev() was not checking for this before
> dereferencing the returned pointer in addrconf_ifid_eui48().
>
> Add a NULL check after calling ionic_lif_netdev() and return -ENODEV if
> no netdev is available.
>
> Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter")
> Signed-off-by: Kamal Heib <kheib@redhat.com>

Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>


-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Leon Romanovsky]

On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> Fix two potential NULL pointer dereferences in the ionic driver by
> adding the missing NULL checks before dereferencing netdev pointers.

How is it possible to have ionic IB driver without netdev?

Thanks

> 
> Kamal Heib (2):
>   RDMA/ionic: Fix potential NULL pointer dereference in
>     ionic_query_device
>   RDMA/ionic: Fix potential NULL pointer dereference in
>     ionic_create_ibdev
> 
>  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> -- 
> 2.55.0
> 
> 

Re: [PATCH rdma-rc 0/2] RDMA/ionic: Fix NULL pointer dereferences

[Kamal Heib]

On Sun, Jul 12, 2026 at 12:13:26PM +0300, Leon Romanovsky wrote:
> On Thu, Jul 09, 2026 at 06:03:51PM -0400, Kamal Heib wrote:
> > Fix two potential NULL pointer dereferences in the ionic driver by
> > adding the missing NULL checks before dereferencing netdev pointers.
> 
> How is it possible to have ionic IB driver without netdev?
> 
> Thanks
>

Thanks for your review, after taking a deeper look:

For Patch 2 (ionic_create_ibdev): You are right. Since lif is embedded in
netdev via netdev_priv() and they are allocated/freed together,
lif->netdev cannot be NULL if lif is valid, Please drop this patch.

For Patch 1 (ionic_query_device): This one should remain.
ib_device_get_netdev() is a core RDMA API that explicitly returns NULL in
multiple code paths:

- Invalid port: if (!rdma_is_port_valid(ib_dev, port)) return NULL;
- No port_data: if (!ib_dev->port_data) return NULL;
- NULL netdev pointer stored in port_data

Also, the return value from ib_device_get_netdev() is being checked in
multiple places in both drivers and the RDMA core.

Let me know what you think?

Thanks,
Kamal

> > 
> > Kamal Heib (2):
> >   RDMA/ionic: Fix potential NULL pointer dereference in
> >     ionic_query_device
> >   RDMA/ionic: Fix potential NULL pointer dereference in
> >     ionic_create_ibdev
> > 
> >  drivers/infiniband/hw/ionic/ionic_ibdev.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> > 
> > -- 
> > 2.55.0
> > 
> > 
>