Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1476556 > unrolled thread

[PATCH] nvme-rdma: fix null pointer dereference on req->mr

Back to article view | Back to linux.kernel

Contents

  [PATCH] nvme-rdma: fix null pointer dereference on req->mr Colin King <colin.king@canonical.com> - 2016-09-05 17:30 +0200
    Re: [PATCH] nvme-rdma: fix null pointer dereference on req->mr Christoph Hellwig <hch@infradead.org> - 2016-09-06 08:30 +0200
    Re: [PATCH] nvme-rdma: fix null pointer dereference on req->mr Sagi Grimberg <sagi@grimberg.me> - 2016-09-06 11:40 +0200

#1476556 — [PATCH] nvme-rdma: fix null pointer dereference on req->mr

From: Colin Ian King <colin.king@canonical.com>

If there is an error on req->mr, req->mr is set to null, however
the following statement sets req->mr->need_inval causing a null
pointer dereference.  Fix this by bailing out to label 'out' to
immediately return and hence skip over the offending null pointer
dereference.

Fixes: f5b7b559e1488 ("nvme-rdma: Get rid of duplicate variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/nvme/host/rdma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index ab545fb..162b8c0 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -291,6 +291,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
 	if (IS_ERR(req->mr)) {
 		ret = PTR_ERR(req->mr);
 		req->mr = NULL;
+		goto out;
 	}
 
 	req->mr->need_inval = false;
-- 
2.9.3

[toc] | [next] | [standalone]

#1477095

On Mon, Sep 05, 2016 at 04:24:38PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> If there is an error on req->mr, req->mr is set to null, however
> the following statement sets req->mr->need_inval causing a null
> pointer dereference.  Fix this by bailing out to label 'out' to
> immediately return and hence skip over the offending null pointer
> dereference.
> 
> Fixes: f5b7b559e1488 ("nvme-rdma: Get rid of duplicate variable")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>

Looks fine,

Reviewed-by: Christoph Hellwig <hch@lst.de>

[toc] | [prev] | [next] | [standalone]

#1477223

Thanks Colin,

queued for the next round of rc fixes.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web