]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/siw: Fix potential NULL pointer dereference in header processing
authorYunJe Shin <yjshin0438@gmail.com>
Wed, 4 Feb 2026 09:24:57 +0000 (18:24 +0900)
committerLeon Romanovsky <leon@kernel.org>
Thu, 5 Feb 2026 12:46:52 +0000 (07:46 -0500)
commit14ab3da122bd18920ad57428f6cf4fade8385142
treefbd57aa671040dedf4ec533b71c656c84cd19be3
parent5551b02fdbfd85a325bb857f3a8f9c9f33397ed2
RDMA/siw: Fix potential NULL pointer dereference in header processing

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),
qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()
dereferences qp->rx_fpdu->more_ddp_segs without checking, which
may lead to a NULL pointer deref. Only check more_ddp_segs when
rx_fpdu is present.

KASAN splat:
[  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
[  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
Link: https://patch.msgid.link/20260204092546.489842-1-ioerts@kookmin.ac.kr
Acked-by: Bernard Metzler <bernard.metzler@linux.dev>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
drivers/infiniband/sw/siw/siw_qp_rx.c