[PATCH net] s390/ctcm: Prevent XID null dereference

[PATCH net] s390/ctcm: Prevent XID null dereference

[Aswin Karuvally]

The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
to signal XID validation error. If peer XID is NULL or r/w channel
pairing mismatch happens, grp->saved_xid2 is never initialized. An
attempt to set the flag in such case leads to NULL dereference.

Fix this by guarding grp->saved_xid2->xid2_flag2 with a NULL check.
Also update mpc_action_go_ready() to treat uninitialized grp->saved_xid2
as validation error.

Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
---
 drivers/s390/net/ctcm_mpc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index aeb102537e7f..a5b55fe6b110 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -826,7 +826,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg)
 
 	fsm_deltimer(&grp->timer);
 
-	if (grp->saved_xid2->xid2_flag2 == 0x40) {
+	if (!grp->saved_xid2 || grp->saved_xid2->xid2_flag2 == 0x40) {
 		priv->xid->xid2_flag2 = 0x00;
 		if (grp->estconnfunc) {
 			grp->estconnfunc(grp->port_num, 1,
@@ -1636,7 +1636,13 @@ static int mpc_validate_xid(struct mpcg_info *mpcginfo)
 			"The XID used in the MPC protocol is not valid, "
 			"rc = %d\n", rc);
 		priv->xid->xid2_flag2 = 0x40;
-		grp->saved_xid2->xid2_flag2 = 0x40;
+
+		/* If xid is NULL (rc=1) or r/w channel pairing mismatch
+		 * (rc=2) happens, grp->saved_xid2 is never initialized
+		 * and becomes NULL
+		 */
+		if (grp->saved_xid2)
+			grp->saved_xid2->xid2_flag2 = 0x40;
 	}
 
 	return rc;
-- 
2.53.0