diff options
| author |   Zhu Yanjun <yanjun.zhu@linux.dev> | 2022-08-21 21:16:13 -0400 |
|---|---|---|
| committer |   Leon Romanovsky <leonro@nvidia.com> | 2022-08-31 09:53:12 +0300 |
| commit | a625ca30eff806395175ebad3ac1399014bdb280 (patch) | |
| tree | 7e5e33b711d83b0304e0833bca99f96e76551fb2 /drivers/infiniband | |
| parent | RDMA/hns: Remove redundant member doorbell_qpn of struct hns_roce_qp (diff) | |
| download | linux-dev-a625ca30eff806395175ebad3ac1399014bdb280.tar.xz linux-dev-a625ca30eff806395175ebad3ac1399014bdb280.zip | |
RDMA/rxe: Fix "kernel NULL pointer dereference" error
When rxe_queue_init in the function rxe_qp_init_req fails,
both qp->req.task.func and qp->req.task.arg are not initialized.
Because of creation of qp fails, the function rxe_create_qp will
call rxe_qp_do_cleanup to handle allocated resource.
Before calling __rxe_do_task, both qp->req.task.func and
qp->req.task.arg should be checked.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20220822011615.805603-2-yanjun.zhu@linux.dev
Reported-by: syzbot+ab99dc4c6e961eed8b8e@syzkaller.appspotmail.com
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_qp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index 516bf9b95e48..fda03f9f03ed 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -797,7 +797,9 @@ static void rxe_qp_do_cleanup(struct work_struct *work) rxe_cleanup_task(&qp->comp.task); /* flush out any receive wr's or pending requests */ - __rxe_do_task(&qp->req.task); + if (qp->req.task.func) + __rxe_do_task(&qp->req.task); + if (qp->sq.queue) { __rxe_do_task(&qp->comp.task); __rxe_do_task(&qp->req.task); |