* [PATCH] driver/infiniband/efa: Fix possible null pointer dereference in `efa_alloc_pd()`
@ 2025-05-13 13:22 Thomas Fourier
2025-05-13 13:31 ` Gal Pressman
0 siblings, 1 reply; 2+ messages in thread
From: Thomas Fourier @ 2025-05-13 13:22 UTC (permalink / raw)
Cc: Thomas Fourier, Michael Margolin, Gal Pressman, Yossi Leybovich,
Jason Gunthorpe, Leon Romanovsky, Shiraz Saleem, Steve Wise,
linux-rdma, linux-kernel
`efa_alloc_pd()` assumes that `udata` is not null but it seems like
`__ib_alloc_pd()` in drivers/infiniband/core/verbs.c:279 can call it
through the `ib_device` interface. This checks if `udata` is null
before dereferencing it.
Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
drivers/infiniband/hw/efa/efa_verbs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index a8645a40730f..fea634b7d825 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -427,7 +427,7 @@ int efa_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
struct efa_pd *pd = to_epd(ibpd);
int err;
- if (udata->inlen &&
+ if (udata && udata->inlen &&
!ib_is_udata_cleared(udata, 0, udata->inlen)) {
ibdev_dbg(&dev->ibdev,
"Incompatible ABI params, udata not cleared\n");
@@ -442,7 +442,7 @@ int efa_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
pd->pdn = result.pdn;
resp.pdn = result.pdn;
- if (udata->outlen) {
+ if (udata && udata->outlen) {
err = ib_copy_to_udata(udata, &resp,
min(sizeof(resp), udata->outlen));
if (err) {
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] driver/infiniband/efa: Fix possible null pointer dereference in `efa_alloc_pd()`
2025-05-13 13:22 [PATCH] driver/infiniband/efa: Fix possible null pointer dereference in `efa_alloc_pd()` Thomas Fourier
@ 2025-05-13 13:31 ` Gal Pressman
0 siblings, 0 replies; 2+ messages in thread
From: Gal Pressman @ 2025-05-13 13:31 UTC (permalink / raw)
To: Thomas Fourier
Cc: Michael Margolin, Yossi Leybovich, Jason Gunthorpe,
Leon Romanovsky, Shiraz Saleem, Steve Wise, linux-rdma,
linux-kernel
On 13/05/2025 16:22, Thomas Fourier wrote:
> `efa_alloc_pd()` assumes that `udata` is not null but it seems like
> `__ib_alloc_pd()` in drivers/infiniband/core/verbs.c:279 can call it
> through the `ib_device` interface. This checks if `udata` is null
> before dereferencing it.
>
> Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
udata will never be NULL since EFA does not support kverbs, and
userspace will always pass udata.
Look at ib_device_check_mandatory().
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-05-13 13:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-13 13:22 [PATCH] driver/infiniband/efa: Fix possible null pointer dereference in `efa_alloc_pd()` Thomas Fourier
2025-05-13 13:31 ` Gal Pressman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox