Re: [PATCH] net: 9p: Fix possible null-pointer dereference in p9_cm_event_handler()
From: Leon Romanovsky <leon@kernel.org>
Date: 2021-08-10 13:55:50
Also in:
lkml
On Tue, Aug 10, 2021 at 06:20:07AM -0700, Tuo Li wrote:
The variable rdma is checked when event->event is equal to RDMA_CM_EVENT_DISCONNECTED: if (rdma) This indicates that it can be NULL. If so, a null-pointer dereference will occur when calling complete(): complete(&rdma->cm_done); To fix this possible null-pointer dereference, calling complete() only when rdma is not NULL.
You need to explain how is it possible and blindly set if () checks. I would say first "if (rdma)" is not needed, but don't know for sure.
quoted hunk ↗ jump to hunk
Reported-by: TOTE Robot <redacted> Signed-off-by: Tuo Li <redacted> --- net/9p/trans_rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c index af0a8a6cd3fd..fb3435dfd071 100644 --- a/net/9p/trans_rdma.c +++ b/net/9p/trans_rdma.c@@ -285,7 +285,8 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) default: BUG(); } - complete(&rdma->cm_done); + if (rdma) + complete(&rdma->cm_done); return 0; }-- 2.25.1