]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
RDMA/rxe: Fix "kernel NULL pointer dereference" error
authorZhu Yanjun <yanjun.zhu@linux.dev>
Mon, 22 Aug 2022 01:16:13 +0000 (21:16 -0400)
committerStefan Bader <stefan.bader@canonical.com>
Thu, 24 Nov 2022 13:24:33 +0000 (14:24 +0100)
commit89fe57add0aad3cebf7930bd47cfdb0bd678881a
tree114a871edbd5090ed4d2e1485ab3ca8164edabf2
parent6f560ebb6314e12644bd447a0704595bb3c84a6e
RDMA/rxe: Fix "kernel NULL pointer dereference" error

BugLink: https://bugs.launchpad.net/bugs/1996825
[ Upstream commit a625ca30eff806395175ebad3ac1399014bdb280 ]

When rxe_queue_init in the function rxe_qp_init_req fails,
both qp->req.task.func and qp->req.task.arg are not initialized.

Because of creation of qp fails, the function rxe_create_qp will
call rxe_qp_do_cleanup to handle allocated resource.

Before calling __rxe_do_task, both qp->req.task.func and
qp->req.task.arg should be checked.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20220822011615.805603-2-yanjun.zhu@linux.dev
Reported-by: syzbot+ab99dc4c6e961eed8b8e@syzkaller.appspotmail.com
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
drivers/infiniband/sw/rxe/rxe_qp.c