* [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer
@ 2020-04-01 22:49 Colin King
2020-04-01 23:40 ` Saleem, Shiraz
2020-04-14 18:51 ` Jason Gunthorpe
0 siblings, 2 replies; 3+ messages in thread
From: Colin King @ 2020-04-01 22:49 UTC (permalink / raw)
To: Faisal Latif, Shiraz Saleem, Doug Ledford, Jason Gunthorpe,
sindhu.devale, linux-rdma
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
Currently the null check for wqe is incorrect and lets a null wqe
be passed to set_64bit_val and this indexes into the null pointer
causing a null pointer dereference. Fix this by fixing the null
pointer check to return an error if wqe is null.
Addresses-Coverity: ("dereference after a null check")
Fixes: 4b34e23f4eaa ("i40iw: Report correct firmware version")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index e8b4b3743661..688f19667221 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -1046,7 +1046,7 @@ i40iw_sc_query_rdma_features(struct i40iw_sc_cqp *cqp,
u64 header;
wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch);
- if (wqe)
+ if (!wqe)
return I40IW_ERR_RING_FULL;
set_64bit_val(wqe, 32, feat_mem->pa);
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer
2020-04-01 22:49 [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer Colin King
@ 2020-04-01 23:40 ` Saleem, Shiraz
2020-04-14 18:51 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Saleem, Shiraz @ 2020-04-01 23:40 UTC (permalink / raw)
To: Colin King, Latif, Faisal, Doug Ledford, Jason Gunthorpe, Devale,
Sindhu, linux-rdma
Cc: kernel-janitors, linux-kernel
> Subject: [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer
>
> From: Colin Ian King <colin.king@canonical.com>
>
> Currently the null check for wqe is incorrect and lets a null wqe be passed to
> set_64bit_val and this indexes into the null pointer causing a null pointer
> dereference. Fix this by fixing the null pointer check to return an error if wqe is
> null.
>
> Addresses-Coverity: ("dereference after a null check")
> Fixes: 4b34e23f4eaa ("i40iw: Report correct firmware version")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Ugh! Yes. That’s a bad one. Thanks for the fix.
Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer
2020-04-01 22:49 [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer Colin King
2020-04-01 23:40 ` Saleem, Shiraz
@ 2020-04-14 18:51 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2020-04-14 18:51 UTC (permalink / raw)
To: Colin King
Cc: Faisal Latif, Shiraz Saleem, Doug Ledford, sindhu.devale,
linux-rdma, kernel-janitors, linux-kernel
On Wed, Apr 01, 2020 at 11:49:21PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Currently the null check for wqe is incorrect and lets a null wqe
> be passed to set_64bit_val and this indexes into the null pointer
> causing a null pointer dereference. Fix this by fixing the null
> pointer check to return an error if wqe is null.
>
> Addresses-Coverity: ("dereference after a null check")
> Fixes: 4b34e23f4eaa ("i40iw: Report correct firmware version")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
> ---
> drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied to for-rc, thanks
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-14 18:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-01 22:49 [PATCH][next] i40iw: fix null pointer dereference on a null wqe pointer Colin King
2020-04-01 23:40 ` Saleem, Shiraz
2020-04-14 18:51 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).