diff options
| author | Zhu Yanjun <yanjun.zhu@linux.dev> | 2022-08-21 21:16:13 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-10-26 13:19:31 +0200 |
| commit | 9c5dd6993c794703e74c6ba17ac78ca0211ef940 (patch) | |
| tree | 31ad5e2123cabc7aa7896191fcf1f4bedc6d77de | |
| parent | 3c38467c3255c428cdbd3cefaccca4662f302dc9 (diff) | |
| download | linux-stable-9c5dd6993c794703e74c6ba17ac78ca0211ef940.tar.gz linux-stable-9c5dd6993c794703e74c6ba17ac78ca0211ef940.tar.bz2 linux-stable-9c5dd6993c794703e74c6ba17ac78ca0211ef940.zip | |
RDMA/rxe: Fix "kernel NULL pointer dereference" error
[ Upstream commit a625ca30eff806395175ebad3ac1399014bdb280 ]
When rxe_queue_init in the function rxe_qp_init_req fails,
both qp->req.task.func and qp->req.task.arg are not initialized.
Because of creation of qp fails, the function rxe_create_qp will
call rxe_qp_do_cleanup to handle allocated resource.
Before calling __rxe_do_task, both qp->req.task.func and
qp->req.task.arg should be checked.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20220822011615.805603-2-yanjun.zhu@linux.dev
Reported-by: syzbot+ab99dc4c6e961eed8b8e@syzkaller.appspotmail.com
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_qp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index a4b5374deac8..476871c8ae44 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -799,7 +799,9 @@ void rxe_qp_destroy(struct rxe_qp *qp) rxe_cleanup_task(&qp->comp.task); /* flush out any receive wr's or pending requests */ - __rxe_do_task(&qp->req.task); + if (qp->req.task.func) + __rxe_do_task(&qp->req.task); + if (qp->sq.queue) { __rxe_do_task(&qp->comp.task); __rxe_do_task(&qp->req.task); |