[PATCH net] s390/ctcm: Prevent XID null dereference
From: Aswin Karuvally <aswin@linux.ibm.com>
Date: 2026-08-09 10:56:00
Also in:
linux-s390, stable
Subsystem:
networking drivers, s390 architecture, s390 network drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Alexandra Winter, Aswin Karuvally, Linus Torvalds
The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
to signal XID validation error. If peer XID is NULL or r/w channel
pairing mismatch happens, grp->saved_xid2 is never initialized. An
attempt to set the flag in such case leads to NULL dereference.
Fix this by guarding grp->saved_xid2->xid2_flag2 with a NULL check.
Also update mpc_action_go_ready() to treat uninitialized grp->saved_xid2
as validation error.
Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
---
drivers/s390/net/ctcm_mpc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index aeb102537e7f..a5b55fe6b110 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c@@ -826,7 +826,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg) fsm_deltimer(&grp->timer); - if (grp->saved_xid2->xid2_flag2 == 0x40) { + if (!grp->saved_xid2 || grp->saved_xid2->xid2_flag2 == 0x40) { priv->xid->xid2_flag2 = 0x00; if (grp->estconnfunc) { grp->estconnfunc(grp->port_num, 1,
@@ -1636,7 +1636,13 @@ static int mpc_validate_xid(struct mpcg_info *mpcginfo) "The XID used in the MPC protocol is not valid, " "rc = %d\n", rc); priv->xid->xid2_flag2 = 0x40; - grp->saved_xid2->xid2_flag2 = 0x40; + + /* If xid is NULL (rc=1) or r/w channel pairing mismatch + * (rc=2) happens, grp->saved_xid2 is never initialized + * and becomes NULL + */ + if (grp->saved_xid2) + grp->saved_xid2->xid2_flag2 = 0x40; } return rc;
--
2.53.0