From: Liu Jian <liujian56@huawei.com>
To: <linux-rdma@vger.kernel.org>, <linux-s390@vger.kernel.org>,
<netdev@vger.kernel.org>
Cc: <jgg@ziepe.ca>, <leon@kernel.org>, <zyjzyj2000@gmail.com>,
<wenjia@linux.ibm.com>, <jaka@linux.ibm.com>,
<alibuda@linux.alibaba.com>, <tonylu@linux.alibaba.com>,
<guwen@linux.alibaba.com>, <davem@davemloft.net>,
<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
<liujian56@huawei.com>
Subject: [PATCH net-next 3/4] net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
Date: Fri, 9 Aug 2024 16:31:47 +0800 [thread overview]
Message-ID: <20240809083148.1989912-4-liujian56@huawei.com> (raw)
In-Reply-To: <20240809083148.1989912-1-liujian56@huawei.com>
BUG: kernel NULL pointer dereference, address: 0000000000000238
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 289 Comm: kworker/3:1 Kdump: loaded Tainted: G OE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Workqueue: smc_hs_wq smc_listen_work [smc]
RIP: 0010:dma_need_sync+0x5/0x60
...
Call Trace:
<TASK>
? dma_need_sync+0x5/0x60
? smc_ib_is_sg_need_sync+0x61/0xf0 [smc]
smcr_buf_map_link+0x24a/0x380 [smc]
__smc_buf_create+0x483/0xb10 [smc]
smc_buf_create+0x21/0xe0 [smc]
smc_listen_work+0xf11/0x14f0 [smc]
? smc_tcp_listen_work+0x364/0x520 [smc]
process_one_work+0x18d/0x3f0
worker_thread+0x304/0x440
kthread+0xe4/0x110
ret_from_fork+0x47/0x70
ret_from_fork_asm+0x1a/0x30
</TASK>
If the software RoCE device is used, ibdev->dma_device is a null pointer.
As a result, the problem occurs. Null pointer detection is added to
prevent problems.
Signed-off-by: Liu Jian <liujian56@huawei.com>
---
net/smc/smc_ib.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 382351ac9434..059822cc3fde 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -748,6 +748,8 @@ bool smc_ib_is_sg_need_sync(struct smc_link *lnk,
buf_slot->sgt[lnk->link_idx].nents, i) {
if (!sg_dma_len(sg))
break;
+ if (!lnk->smcibdev->ibdev->dma_device)
+ break;
if (dma_need_sync(lnk->smcibdev->ibdev->dma_device,
sg_dma_address(sg))) {
ret = true;
--
2.34.1
next prev parent reply other threads:[~2024-08-09 8:34 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-09 8:31 [PATCH net-next 0/4] Make SMC-R can work with rxe devices Liu Jian
2024-08-09 8:31 ` [PATCH net-next 1/4] rdma/device: export ib_device_get_netdev() Liu Jian
2024-08-09 8:31 ` [PATCH net-next 2/4] net/smc: use ib_device_get_netdev() helper to get netdev info Liu Jian
2024-08-09 14:59 ` Dust Li
2024-08-12 2:07 ` liujian (CE)
2024-08-12 2:43 ` Dust Li
2024-08-09 8:31 ` Liu Jian [this message]
2024-08-09 10:01 ` [PATCH net-next 3/4] net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() Wen Gu
2024-08-09 14:59 ` Dust Li
2024-08-12 3:30 ` D. Wythe
2024-08-09 8:31 ` [PATCH net-next 4/4] RDMA/rxe: Set queue pair cur_qp_state when being queried Liu Jian
2024-08-09 11:06 ` Zhu Yanjun
2024-08-11 8:31 ` Leon Romanovsky
[not found] ` <bb0a5de8-f2d3-4276-ada4-f788f574b798@linux.dev>
2024-08-11 10:24 ` Zhu Yanjun
2024-08-11 6:05 ` [PATCH net-next 0/4] Make SMC-R can work with rxe devices Jan Karcher
2024-08-20 13:16 ` Jan Karcher
2024-08-21 1:03 ` Dust Li
2024-08-24 10:04 ` liujian (CE)
2024-08-26 19:04 ` Jan Karcher
2024-08-28 10:29 ` liujian (CE)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240809083148.1989912-4-liujian56@huawei.com \
--to=liujian56@huawei.com \
--cc=alibuda@linux.alibaba.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=guwen@linux.alibaba.com \
--cc=jaka@linux.ibm.com \
--cc=jgg@ziepe.ca \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=tonylu@linux.alibaba.com \
--cc=wenjia@linux.ibm.com \
--cc=zyjzyj2000@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox