From: Bernard Metzler <bernard.metzler@linux.dev>
To: YunJe Shin <yjshin0438@gmail.com>, jgg@ziepe.ca, leon@kernel.org
Cc: joonkyoj@yonsei.ac.kr, ioerts@kookmin.ac.kr, linux-rdma@vger.kernel.org
Subject: Re: [PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing
Date: Wed, 4 Feb 2026 11:06:58 +0100 [thread overview]
Message-ID: <417e8676-cdaa-44a8-aa42-a5e5dc201171@linux.dev> (raw)
In-Reply-To: <20260204092546.489842-1-ioerts@kookmin.ac.kr>
On 04.02.2026 10:24, YunJe Shin wrote:
>
> If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),
> qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()
> dereferences qp->rx_fpdu->more_ddp_segs without checking, which
> may lead to a NULL pointer deref. Only check more_ddp_segs when
> rx_fpdu is present.
>
> KASAN splat:
> [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
> [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50
>
> Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
> Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
>
> v2:
> - keep srx->state > SIW_GET_HDR completion path intact
> - guard qp->rx_fpdu before checking more_ddp_segs
> ---
> drivers/infiniband/sw/siw/siw_qp_rx.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
> index a10820e33887..e8a88b378d51 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_rx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
> @@ -1435,7 +1435,8 @@ int siw_tcp_rx_data(read_descriptor_t *rd_desc, struct sk_buff *skb,
> }
> if (unlikely(rv != 0 && rv != -EAGAIN)) {
> if ((srx->state > SIW_GET_HDR ||
> - qp->rx_fpdu->more_ddp_segs) && run_completion)
> + (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) &&
> + run_completion)
> siw_rdmap_complete(qp, rv);
>
> siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv,
Acked-by: Bernard Metzler <bernard.metzler@linux.dev>
next prev parent reply other threads:[~2026-02-04 10:07 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-04 9:24 [PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing YunJe Shin
2026-02-04 10:06 ` Bernard Metzler [this message]
2026-02-05 12:53 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=417e8676-cdaa-44a8-aa42-a5e5dc201171@linux.dev \
--to=bernard.metzler@linux.dev \
--cc=ioerts@kookmin.ac.kr \
--cc=jgg@ziepe.ca \
--cc=joonkyoj@yonsei.ac.kr \
--cc=leon@kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=yjshin0438@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox