| From 14ab3da122bd18920ad57428f6cf4fade8385142 Mon Sep 17 00:00:00 2001 |
| From: YunJe Shin <yjshin0438@gmail.com> |
| Date: Wed, 4 Feb 2026 18:24:57 +0900 |
| Subject: RDMA/siw: Fix potential NULL pointer dereference in header processing |
| |
| From: YunJe Shin <yjshin0438@gmail.com> |
| |
| commit 14ab3da122bd18920ad57428f6cf4fade8385142 upstream. |
| |
| If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), |
| qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() |
| dereferences qp->rx_fpdu->more_ddp_segs without checking, which |
| may lead to a NULL pointer deref. Only check more_ddp_segs when |
| rx_fpdu is present. |
| |
| KASAN splat: |
| [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] |
| [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50 |
| |
| Fixes: 8b6a361b8c48 ("rdma/siw: receive path") |
| Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr> |
| Link: https://patch.msgid.link/20260204092546.489842-1-ioerts@kookmin.ac.kr |
| Acked-by: Bernard Metzler <bernard.metzler@linux.dev> |
| Signed-off-by: Leon Romanovsky <leon@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/infiniband/sw/siw/siw_qp_rx.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/infiniband/sw/siw/siw_qp_rx.c |
| +++ b/drivers/infiniband/sw/siw/siw_qp_rx.c |
| @@ -1456,7 +1456,8 @@ int siw_tcp_rx_data(read_descriptor_t *r |
| } |
| if (unlikely(rv != 0 && rv != -EAGAIN)) { |
| if ((srx->state > SIW_GET_HDR || |
| - qp->rx_fpdu->more_ddp_segs) && run_completion) |
| + (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) && |
| + run_completion) |
| siw_rdmap_complete(qp, rv); |
| |
| siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv, |
