2023-01-26 18:52:56

by Nikita Zhandarovich

Subject: [PATCH] RDMA/irdma: Fix potential NULL-ptr-dereference

in_dev_get() can return NULL which will cause a failure once idev is
dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
check for NULL value in idev beforehand.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
Signed-off-by: Nikita Zhandarovich <[email protected]>

drivers/infiniband/hw/irdma/cm.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c
index 7b086fe63a24..195aa9ea18b6 100644
--- a/drivers/infiniband/hw/irdma/cm.c
+++ b/drivers/infiniband/hw/irdma/cm.c
@@ -1722,6 +1722,9 @@ static int irdma_add_mqh_4(struct irdma_device *iwdev,
continue;

idev = in_dev_get(ip_dev);
+ if (!idev)
+ continue;
+
in_dev_for_each_ifa_rtnl(ifa, idev) {
ibdev_dbg(&iwdev->ibdev,
"CM: Allocating child CM Listener forIP=%pI4, vlan_id=%d, MAC=%pM\n",

2023-01-27 15:39:09

by Devale, Sindhu

Subject: RE: [PATCH] RDMA/irdma: Fix potential NULL-ptr-dereference

> -----Original Message-----
> From: Nikita Zhandarovich <[email protected]>
> Sent: Thursday, January 26, 2023 12:53 PM
> To: Ismail, Mustafa <[email protected]>
> Cc: Nikita Zhandarovich <[email protected]>; Saleem, Shiraz
> <[email protected]>; Jason Gunthorpe <[email protected]>; Leon
> Romanovsky <[email protected]>; [email protected]; linux-
> [email protected]; [email protected]
> Subject: [PATCH] RDMA/irdma: Fix potential NULL-ptr-dereference
>
> in_dev_get() can return NULL which will cause a failure once idev is
> dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for
> NULL value in idev beforehand.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
> Signed-off-by: Nikita Zhandarovich <[email protected]>
>
> drivers/infiniband/hw/irdma/cm.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/infiniband/hw/irdma/cm.c
> b/drivers/infiniband/hw/irdma/cm.c
> index 7b086fe63a24..195aa9ea18b6 100644
> --- a/drivers/infiniband/hw/irdma/cm.c
> +++ b/drivers/infiniband/hw/irdma/cm.c
> @@ -1722,6 +1722,9 @@ static int irdma_add_mqh_4(struct irdma_device
> *iwdev,
> continue;
>
> idev = in_dev_get(ip_dev);
> + if (!idev)
> + continue;
> +
> in_dev_for_each_ifa_rtnl(ifa, idev) {
> ibdev_dbg(&iwdev->ibdev,
> "CM: Allocating child CM Listener
> forIP=%pI4, vlan_id=%d, MAC=%pM\n",

Change looks good. Thanks!

Reviewed-by: Sindhu Devale <[email protected]>

2023-01-29 12:58:04

by Leon Romanovsky

Subject: Re: [PATCH] RDMA/irdma: Fix potential NULL-ptr-dereference

On Thu, 26 Jan 2023 10:52:30 -0800, Nikita Zhandarovich wrote:
> in_dev_get() can return NULL which will cause a failure once idev is
> dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
> check for NULL value in idev beforehand.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
> Signed-off-by: Nikita Zhandarovich <[email protected]>
>
> [...]

Applied, thanks!

[1/1] RDMA/irdma: Fix potential NULL-ptr-dereference
https://git.kernel.org/rdma/rdma/c/5d9745cead1f12

Best regards,
--
Leon Romanovsky <[email protected]>