* [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry()
@ 2023-02-14 15:43 Dan Carpenter
2023-02-15 11:37 ` Leon Romanovsky
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2023-02-14 15:43 UTC (permalink / raw)
To: Steve Wise
Cc: Potnuri Bharat Teja, Jason Gunthorpe, Leon Romanovsky,
Doug Ledford, linux-rdma, kernel-janitors
This condition needs to match the previous "if (epcp->state == LISTEN) {"
exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
problem is that "epcp" has been re-assigned so just testing
"if (epcp->state == LISTEN) {" a second time is not sufficient.
Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
From static analysis, not from testing. It's possible that the current
code works but this change makes it more Obviously Correct[tm].
drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c
index ff645b955a08..fd22c85d35f4 100644
--- a/drivers/infiniband/hw/cxgb4/restrack.c
+++ b/drivers/infiniband/hw/cxgb4/restrack.c
@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg,
if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history))
goto err_cancel_table;
- if (epcp->state == LISTEN) {
+ if (listen_ep) {
if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid))
goto err_cancel_table;
if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
--
2.35.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry()
@ 2023-02-14 15:49 Dan Carpenter
2023-02-14 15:51 ` Dan Carpenter
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2023-02-14 15:49 UTC (permalink / raw)
To: Steve Wise
Cc: Potnuri Bharat Teja, Jason Gunthorpe, Leon Romanovsky,
Doug Ledford, linux-rdma, kernel-janitors
This condition needs to match the previous "if (epcp->state == LISTEN) {"
exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
problem is that "epcp" has been re-assigned so just testing
"if (epcp->state == LISTEN) {" a second time is not sufficient.
Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
From static analysis, not from testing. It's possible that the current
code works but this change makes it more Obviously Correct[tm].
drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c
index ff645b955a08..fd22c85d35f4 100644
--- a/drivers/infiniband/hw/cxgb4/restrack.c
+++ b/drivers/infiniband/hw/cxgb4/restrack.c
@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg,
if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history))
goto err_cancel_table;
- if (epcp->state == LISTEN) {
+ if (listen_ep) {
if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid))
goto err_cancel_table;
if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
--
2.35.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry()
2023-02-14 15:49 [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry() Dan Carpenter
@ 2023-02-14 15:51 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2023-02-14 15:51 UTC (permalink / raw)
To: Steve Wise
Cc: Potnuri Bharat Teja, Jason Gunthorpe, Leon Romanovsky,
Doug Ledford, linux-rdma, kernel-janitors
On Tue, Feb 14, 2023 at 06:49:03PM +0300, Dan Carpenter wrote:
> This condition needs to match the previous "if (epcp->state == LISTEN) {"
> exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
> problem is that "epcp" has been re-assigned so just testing
> "if (epcp->state == LISTEN) {" a second time is not sufficient.
>
> Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> >From static analysis, not from testing. It's possible that the current
> code works but this change makes it more Obviously Correct[tm].
>
Oops. I accidentally sent this twice. Sorry!
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry()
2023-02-14 15:43 Dan Carpenter
@ 2023-02-15 11:37 ` Leon Romanovsky
0 siblings, 0 replies; 4+ messages in thread
From: Leon Romanovsky @ 2023-02-15 11:37 UTC (permalink / raw)
To: Steve Wise, Dan Carpenter
Cc: Potnuri Bharat Teja, Jason Gunthorpe, Doug Ledford, linux-rdma,
kernel-janitors
On Tue, 14 Feb 2023 18:43:38 +0300, Dan Carpenter wrote:
> This condition needs to match the previous "if (epcp->state == LISTEN) {"
> exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
> problem is that "epcp" has been re-assigned so just testing
> "if (epcp->state == LISTEN) {" a second time is not sufficient.
>
>
Applied, thanks!
[1/1] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry()
https://git.kernel.org/rdma/rdma/c/4ca446b127c568
Best regards,
--
Leon Romanovsky <leon@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-02-15 11:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-14 15:49 [PATCH] iw_cxgb4: potential NULL dereference in c4iw_fill_res_cm_id_entry() Dan Carpenter
2023-02-14 15:51 ` Dan Carpenter
-- strict thread matches above, loose matches on Subject: below --
2023-02-14 15:43 Dan Carpenter
2023-02-15 11:37 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox