| Message ID | 20210810132007.296008-1-islituo@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | net: 9p: Fix possible null-pointer dereference in p9_cm_event_handler() | expand |
On Tue, Aug 10, 2021 at 06:20:07AM -0700, Tuo Li wrote: > The variable rdma is checked when event->event is equal to > RDMA_CM_EVENT_DISCONNECTED: > if (rdma) > > This indicates that it can be NULL. If so, a null-pointer dereference will > occur when calling complete(): > complete(&rdma->cm_done); > > To fix this possible null-pointer dereference, calling complete() only > when rdma is not NULL. You need to explain how is it possible and blindly set if () checks. I would say first "if (rdma)" is not needed, but don't know for sure. > > Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> > Signed-off-by: Tuo Li <islituo@gmail.com> > --- > net/9p/trans_rdma.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c > index af0a8a6cd3fd..fb3435dfd071 100644 > --- a/net/9p/trans_rdma.c > +++ b/net/9p/trans_rdma.c > @@ -285,7 +285,8 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) > default: > BUG(); > } > - complete(&rdma->cm_done); > + if (rdma) > + complete(&rdma->cm_done); > return 0; > } > > -- > 2.25.1 >
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c index af0a8a6cd3fd..fb3435dfd071 100644 --- a/net/9p/trans_rdma.c +++ b/net/9p/trans_rdma.c @@ -285,7 +285,8 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) default: BUG(); } - complete(&rdma->cm_done); + if (rdma) + complete(&rdma->cm_done); return 0; }
The variable rdma is checked when event->event is equal to RDMA_CM_EVENT_DISCONNECTED: if (rdma) This indicates that it can be NULL. If so, a null-pointer dereference will occur when calling complete(): complete(&rdma->cm_done); To fix this possible null-pointer dereference, calling complete() only when rdma is not NULL. Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Tuo Li <islituo@gmail.com> --- net/9p/trans_rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)