diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-26 22:17:05 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-07-27 13:58:12 -0700 |
| commit | c7ba50fe2399f0621fae39eb6f5e6abfbb83c38d (patch) | |
| tree | 22b6f6c1191df43be0b299e4b3c0110748e347b6 /net | |
| parent | a0d57a552b836206ad7705a1060e6e1ce5a38203 (diff) | |
| download | linux-0-day-c7ba50fe2399f0621fae39eb6f5e6abfbb83c38d.tar.gz linux-0-day-c7ba50fe2399f0621fae39eb6f5e6abfbb83c38d.tar.xz | |
net: rds: Fix possible null-pointer dereferences in rds_rdma_cm_event_handler_cmn()
In rds_rdma_cm_event_handler_cmn(), there are some if statements to
check whether conn is NULL, such as on lines 65, 96 and 112.
But conn is not checked before being used on line 108:
trans->cm_connect_complete(conn, event);
and on lines 140-143:
rdsdebug("DISCONNECT event - dropping connection "
"%pI6c->%pI6c\n", &conn->c_laddr,
&conn->c_faddr);
rds_conn_drop(conn);
Thus, possible null-pointer dereferences may occur.
To fix these bugs, conn is checked before being used.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/rds/rdma_transport.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index ff74c4bbb9fc8..9986d6065c4d1 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -105,7 +105,8 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, break; case RDMA_CM_EVENT_ESTABLISHED: - trans->cm_connect_complete(conn, event); + if (conn) + trans->cm_connect_complete(conn, event); break; case RDMA_CM_EVENT_REJECTED: @@ -137,6 +138,8 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, break; case RDMA_CM_EVENT_DISCONNECTED: + if (!conn) + break; rdsdebug("DISCONNECT event - dropping connection " "%pI6c->%pI6c\n", &conn->c_laddr, &conn->c_faddr); |