Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH] net: 9p: Fix possible null-pointer dereferences in p9_cm_event_handler() | Date | Wed, 24 Jul 2019 18:39:48 +0800 |
| |
In p9_cm_event_handler(), there is an if statement on 260 to check whether rdma is NULL, which indicates that rdma can be NULL. If so, using rdma->xxx may cause a possible null-pointer dereference.
To fix these bugs, rdma is checked before being used.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- net/9p/trans_rdma.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c index bac8dad5dd69..eba3c5fc2731 100644 --- a/net/9p/trans_rdma.c +++ b/net/9p/trans_rdma.c @@ -242,18 +242,24 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) struct p9_trans_rdma *rdma = c->trans; switch (event->event) { case RDMA_CM_EVENT_ADDR_RESOLVED: - BUG_ON(rdma->state != P9_RDMA_INIT); - rdma->state = P9_RDMA_ADDR_RESOLVED; + if (rdma) { + BUG_ON(rdma->state != P9_RDMA_INIT); + rdma->state = P9_RDMA_ADDR_RESOLVED; + } break; case RDMA_CM_EVENT_ROUTE_RESOLVED: - BUG_ON(rdma->state != P9_RDMA_ADDR_RESOLVED); - rdma->state = P9_RDMA_ROUTE_RESOLVED; + if (rdma) { + BUG_ON(rdma->state != P9_RDMA_ADDR_RESOLVED); + rdma->state = P9_RDMA_ROUTE_RESOLVED; + } break; case RDMA_CM_EVENT_ESTABLISHED: - BUG_ON(rdma->state != P9_RDMA_ROUTE_RESOLVED); - rdma->state = P9_RDMA_CONNECTED; + if (rdma) { + BUG_ON(rdma->state != P9_RDMA_ROUTE_RESOLVED); + rdma->state = P9_RDMA_CONNECTED; + } break; case RDMA_CM_EVENT_DISCONNECTED: @@ -277,12 +283,14 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) case RDMA_CM_EVENT_ADDR_ERROR: case RDMA_CM_EVENT_UNREACHABLE: c->status = Disconnected; - rdma_disconnect(rdma->cm_id); + if (rdma) + rdma_disconnect(rdma->cm_id); break; default: BUG(); } - complete(&rdma->cm_done); + if (rdma) + complete(&rdma->cm_done); return 0; } -- 2.17.0
| |