[PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing

[PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing

[YunJe Shin]

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),
qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()
dereferences qp->rx_fpdu->more_ddp_segs without checking, which
may lead to a NULL pointer deref. Only check more_ddp_segs when
rx_fpdu is present.

KASAN splat:
[  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
[  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>

v2:
- keep srx->state > SIW_GET_HDR completion path intact
- guard qp->rx_fpdu before checking more_ddp_segs
---
 drivers/infiniband/sw/siw/siw_qp_rx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
index a10820e33887..e8a88b378d51 100644
--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
@@ -1435,7 +1435,8 @@ int siw_tcp_rx_data(read_descriptor_t *rd_desc, struct sk_buff *skb,
 		}
 		if (unlikely(rv != 0 && rv != -EAGAIN)) {
 			if ((srx->state > SIW_GET_HDR ||
-			     qp->rx_fpdu->more_ddp_segs) && run_completion)
+			     (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) &&
+			    run_completion)
 				siw_rdmap_complete(qp, rv);
 
 			siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv,
-- 
2.43.0

Re: [PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing

[Bernard Metzler]

On 04.02.2026 10:24, YunJe Shin wrote:
> 
> If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),
> qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()
> dereferences qp->rx_fpdu->more_ddp_segs without checking, which
> may lead to a NULL pointer deref. Only check more_ddp_segs when
> rx_fpdu is present.
> 
> KASAN splat:
> [  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
> [  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50
> 
> Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
> Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
> 
> v2:
> - keep srx->state > SIW_GET_HDR completion path intact
> - guard qp->rx_fpdu before checking more_ddp_segs
> ---
>   drivers/infiniband/sw/siw/siw_qp_rx.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
> index a10820e33887..e8a88b378d51 100644
> --- a/drivers/infiniband/sw/siw/siw_qp_rx.c
> +++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
> @@ -1435,7 +1435,8 @@ int siw_tcp_rx_data(read_descriptor_t *rd_desc, struct sk_buff *skb,
>   		}
>   		if (unlikely(rv != 0 && rv != -EAGAIN)) {
>   			if ((srx->state > SIW_GET_HDR ||
> -			     qp->rx_fpdu->more_ddp_segs) && run_completion)
> +			     (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) &&
> +			    run_completion)
>   				siw_rdmap_complete(qp, rv);
>   
>   			siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv,

Acked-by: Bernard Metzler <bernard.metzler@linux.dev>

Re: [PATCH v2] RDMA/siw: Fix potential NULL pointer dereference in header processing

[Leon Romanovsky]

On Wed, 04 Feb 2026 18:24:57 +0900, YunJe Shin wrote:
> If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),
> qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()
> dereferences qp->rx_fpdu->more_ddp_segs without checking, which
> may lead to a NULL pointer deref. Only check more_ddp_segs when
> rx_fpdu is present.
> 
> KASAN splat:
> [  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
> [  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50
> 
> [...]

Applied, thanks!

[1/1] RDMA/siw: Fix potential NULL pointer dereference in header processing
      https://git.kernel.org/rdma/rdma/c/14ab3da122bd18

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>