[PATCH net v2] s390/ctcm: Prevent XID null dereference

[PATCH net v2] s390/ctcm: Prevent XID null dereference

[Aswin Karuvally]

The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
to signal XID validation error. If peer XID is NULL or r/w channel
pairing mismatch happens, grp->saved_xid2 is never initialized. An
attempt to set the flag in such case leads to NULL dereference.

Fix this by using the always available priv->xid->xid2_flag2 instead of
grp->saved_xid2->xid2_flag2 for validation errors.

Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
---
Changes in v2:
* Ensure FSM goes to INOP for XID validation failure of either channel

 drivers/s390/net/ctcm_mpc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index 08e36685e578..61c88fe853c5 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -826,7 +826,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg)
 
 	fsm_deltimer(&grp->timer);
 
-	if (grp->saved_xid2->xid2_flag2 == 0x40) {
+	if (priv->xid->xid2_flag2 == 0x40) {
 		priv->xid->xid2_flag2 = 0x00;
 		if (grp->estconnfunc) {
 			grp->estconnfunc(grp->port_num, 1,
@@ -1636,7 +1636,6 @@ static int mpc_validate_xid(struct mpcg_info *mpcginfo)
 			"The XID used in the MPC protocol is not valid, "
 			"rc = %d\n", rc);
 		priv->xid->xid2_flag2 = 0x40;
-		grp->saved_xid2->xid2_flag2 = 0x40;
 	}
 
 	return rc;

base-commit: f967455fb2a5a2079b9eb5823e9ccf359174bf9f
-- 
2.53.0

Re: [PATCH net v2] s390/ctcm: Prevent XID null dereference

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Aug 2026 08:34:08 +0200 you wrote:
> The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
> to signal XID validation error. If peer XID is NULL or r/w channel
> pairing mismatch happens, grp->saved_xid2 is never initialized. An
> attempt to set the flag in such case leads to NULL dereference.
> 
> Fix this by using the always available priv->xid->xid2_flag2 instead of
> grp->saved_xid2->xid2_flag2 for validation errors.
> 
> [...]

Here is the summary with links:
  - [net,v2] s390/ctcm: Prevent XID null dereference
    https://git.kernel.org/netdev/net/c/b264d8422779

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html