Skip to contentSkip to conversation

RDMA/cxgb4: Protect from possible dereference

PATCH Applied Leon Romanovsky 3 participants 4 messages Oct 29, 2017 – Nov 13, 2017 1 message not in the archive

Subsystems (2)
InfiniBand CXGB4 iWARP RNIC driver (IW_CXGB4)
lore
Share & tools
lore

Leon Romanovsky

author
#0 lore raw

PATCH 1/1 RDMA/cxgb4: Protect from possible dereference

Smatch tool reports the following error:
drivers/infiniband/hw/cxgb4/qp.c:1886
c4iw_create_qp() error: we previously assumed 'ucontext' could be null (see line 1804)

Cc Steve Wise <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/infiniband/hw/cxgb4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/qp.c +1 -1
index 57b23e33eb8b..4b3267358dff 100644
@@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
 	if (ret)
 		goto err_destroy_qp;
 
-	if (udata) {
+	if (udata && ucontext) {
 		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
 		if (!sq_key_mm) {
 			ret = -ENOMEM;

--
2.14.2

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 20171029193435.314-1-leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org

Reviewed-by
#2 lore raw
Quoted 26 lines

Smatch tool reports the following error:
drivers/infiniband/hw/cxgb4/qp.c:1886
c4iw_create_qp() error: we previously assumed 'ucontext' could be null (see line 1804)

Cc Steve Wise <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/infiniband/hw/cxgb4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/qp.c +1 -1
index 57b23e33eb8b..4b3267358dff 100644
@@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
 struct ib_qp_init_attr *attrs,
 	if (ret)
 		goto err_destroy_qp;
 
-	if (udata) {
+	if (udata && ucontext) {
 		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
 		if (!sq_key_mm) {
Quoted 1 line

ret = -ENOMEM;

Hey Leon, doesn't udata imply ucontext? It's not a big deal, though, I
guess.

Reviewed-by Steve Wise <[email protected]>

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

author
#3 lore raw
Quoted 22 lines · Steve Wise
Quoted 22 lines

Smatch tool reports the following error:
drivers/infiniband/hw/cxgb4/qp.c:1886
c4iw_create_qp() error: we previously assumed 'ucontext' could be null (see line 1804)

Cc Steve Wise <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/infiniband/hw/cxgb4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/qp.c +0 -0
index 57b23e33eb8b..4b3267358dff 100644
@@ -1843,7 +1843,7 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
 struct ib_qp_init_attr *attrs,
 	if (ret)
 		goto err_destroy_qp;
Quoted 9 lines
Quoted 5 lines
drivers/infiniband/hw/cxgb4/qp.c +1 -1
-	if (udata) {
+	if (udata && ucontext) {
 		sq_key_mm = kmalloc(sizeof(*sq_key_mm), GFP_KERNEL);
 		if (!sq_key_mm) {

ret = -ENOMEM;

Hey Leon, doesn't udata imply ucontext? It's not a big deal, though, I
guess.

Yes, it is, but I don't see any other option to clean RDMA.

➜ linux-rdma git:(rdma-next) x checks
Preparing /tmp/tmp.rkPKPYnNE2 (identifier tmp.rkPKPYnNE2) Checking out files: 100% (61292/61292), done.
HEAD is now at e183225dff87 RDMA/cxgb4: Protect from possible dereference Redirecting the output to /tmp/tmp.VZsidBz0jJ
There are 387 errors/warnings

Quoted 3 lines
Reviewed-by Steve Wise <[email protected]>

Thanks

Quoted 1 line
Applied
#4 lore raw
In reply to a message not in the archive
Quoted 7 lines · Leon Romanovsky

Smatch tool reports the following error:
drivers/infiniband/hw/cxgb4/qp.c:1886
c4iw_create_qp() error: we previously assumed 'ucontext' could be null (see line 1804)

Cc Steve Wise <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>

Thanks, applied.

Signature · 3 lines
Doug Ledford <[email protected]>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD