2021-08-11 03:32:01

by Tuo Li

Subject: [BUG] net: qed: possible null-pointer dereference in qed_rdma_create_qp()

Hello,

Our static analysis tool finds a possible null-pointer dereference in
qed_rdma.c in Linux 5.14.0-rc3:

The variable rdma_cxt is assigned to p_hwfn, and rdma_cxt is checked in:
1286:    if (!rdma_cxt || !in_params || !out_params ||
!p_hwfn->p_rdma_info->active)

This indicates that both rdma_cxt and p_hwfn can be NULL. If so, a
null-pointer dereference will occur:
1288:    DP_ERR(p_hwfn->cdev, ...);

I am not quite sure whether this possible null-pointer dereference is
real and how to fix it if it is real.
Any feedback would be appreciated, thanks!

Reported-by: TOTE Robot <[email protected]>

Best wishes,
Tuo Li

2021-08-11 09:45:48

by Shai Malin

Subject: RE: [BUG] net: qed: possible null-pointer dereference in qed_rdma_create_qp()

On 8/11/21 6:30 AM, Tuo Li wrote:
> Hello,
>
> Our static analysis tool finds a possible null-pointer dereference in
> qed_rdma.c in Linux 5.14.0-rc3:
>
> The variable rdma_cxt is assigned to p_hwfn, and rdma_cxt is checked in:
> 1286:    if (!rdma_cxt || !in_params || !out_params ||
> !p_hwfn->p_rdma_info->active)
>
> This indicates that both rdma_cxt and p_hwfn can be NULL. If so, a
> null-pointer dereference will occur:
> 1288:    DP_ERR(p_hwfn->cdev, ...);
>
> I am not quite sure whether this possible null-pointer dereference is
> real and how to fix it if it is real.
> Any feedback would be appreciated, thanks!
>
> Reported-by: TOTE Robot <[email protected]>

Thanks! It's a real issue.
We will send a fix.

>
> Best wishes,
> Tuo Li