From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933224AbbIDRcV (ORCPT ); Fri, 4 Sep 2015 13:32:21 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:28466 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932791AbbIDRcT (ORCPT ); Fri, 4 Sep 2015 13:32:19 -0400 Subject: Re: [PATCH] RDS: verify the underlying transport exists before creating a connection To: Sasha Levin , chien.yen@oracle.com, davem@davemloft.net References: <1441385019-27019-1-git-send-email-sasha.levin@oracle.com> Cc: rds-devel@oss.oracle.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org From: santosh shilimkar Organization: Oracle Corporation Message-ID: <55E9D59E.4080103@oracle.com> Date: Fri, 4 Sep 2015 10:32:14 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <1441385019-27019-1-git-send-email-sasha.levin@oracle.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Sasha, On 9/4/2015 9:43 AM, Sasha Levin wrote: > There was no verification that an underlying transport exists when creating > a connection, this would cause dereferencing a NULL ptr. > > Signed-off-by: Sasha Levin > --- > net/rds/connection.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/net/rds/connection.c b/net/rds/connection.c > index a50e652..0218d81 100644 > --- a/net/rds/connection.c > +++ b/net/rds/connection.c > @@ -189,6 +189,12 @@ new_conn: > } > } > > + if (trans == NULL) { > + kmem_cache_free(rds_conn_slab, conn); > + conn = ERR_PTR(-ENODEV); > + goto out; > + } > + Did you see the NULL oops in any tests ? The reason am asking this because callers of '__rds_conn_create()' are not passing the trans as null so that leaves with only the loopback case. In that case as well, rds_loop_transport is never going to be null. The check is good but am curious whether we have a case which will hit this scenario. Regards, Santosh