|
Jiri Slaby |
ef7db2 |
From: Dan Carpenter <error27@gmail.com>
|
|
Jiri Slaby |
ef7db2 |
Date: Tue, 14 Feb 2023 18:43:38 +0300
|
|
Jiri Slaby |
ef7db2 |
Subject: [PATCH] iw_cxgb4: Fix potential NULL dereference in
|
|
Jiri Slaby |
ef7db2 |
c4iw_fill_res_cm_id_entry()
|
|
Jiri Slaby |
ef7db2 |
References: bsc#1012628
|
|
Jiri Slaby |
ef7db2 |
Patch-mainline: 6.2.3
|
|
Jiri Slaby |
ef7db2 |
Git-commit: 4ca446b127c568b59cb8d9748b6f70499624bb18
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ]
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
This condition needs to match the previous "if (epcp->state == LISTEN) {"
|
|
Jiri Slaby |
ef7db2 |
exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
|
|
Jiri Slaby |
ef7db2 |
problem is that "epcp" has been re-assigned so just testing
|
|
Jiri Slaby |
ef7db2 |
"if (epcp->state == LISTEN) {" a second time is not sufficient.
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Dan Carpenter <error27@gmail.com>
|
|
Jiri Slaby |
ef7db2 |
Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
|
|
Jiri Slaby |
ef7db2 |
---
|
|
Jiri Slaby |
ef7db2 |
drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
|
|
Jiri Slaby |
ef7db2 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c
|
|
Jiri Slaby |
ef7db2 |
index ff645b95..fd22c85d 100644
|
|
Jiri Slaby |
ef7db2 |
--- a/drivers/infiniband/hw/cxgb4/restrack.c
|
|
Jiri Slaby |
ef7db2 |
+++ b/drivers/infiniband/hw/cxgb4/restrack.c
|
|
Jiri Slaby |
ef7db2 |
@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg,
|
|
Jiri Slaby |
ef7db2 |
if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history))
|
|
Jiri Slaby |
ef7db2 |
goto err_cancel_table;
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
- if (epcp->state == LISTEN) {
|
|
Jiri Slaby |
ef7db2 |
+ if (listen_ep) {
|
|
Jiri Slaby |
ef7db2 |
if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid))
|
|
Jiri Slaby |
ef7db2 |
goto err_cancel_table;
|
|
Jiri Slaby |
ef7db2 |
if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
|
|
Jiri Slaby |
ef7db2 |
--
|
|
Jiri Slaby |
ef7db2 |
2.35.3
|
|
Jiri Slaby |
ef7db2 |
|