diff options
| author | Cheng Xu <[email protected]> | 2023-09-08 14:05:59 +0800 |
|---|---|---|
| committer | Leon Romanovsky <[email protected]> | 2023-09-18 10:42:19 +0300 |
| commit | b2abdffb505f7e1bef1a769ba7cbdc819a6fe623 (patch) | |
| tree | 3a37a6fd5094ff2395eff867a3d2142603e36e00 /lib/test_fortify/write_overflow-strncpy-src.c | |
| parent | 6b5f0749ce48c13d7f53b27c39d00bba46e1fd1c (diff) | |
RDMA/erdma: Fix NULL pointer access in regmr_cmd
Fix the crash of regmr_cmd called by erdma_ib_alloc_mr. The reason is
that mr->mem.mtt is not initialized but it is accessed in regmr_cmd.
The call trace information:
BUG: kernel NULL pointer dereference, address: 0000000000000000
<...>
RIP: 0010:regmr_cmd+0x170/0x1c0 [erdma]
<...>
Call Trace:
? __die+0x20/0x70
? page_fault_oops+0x66/0x150
? do_user_addr_fault+0x61/0x660
? exc_page_fault+0x65/0x140
? asm_exc_page_fault+0x22/0x30
? regmr_cmd+0x170/0x1c0 [erdma]
? preempt_count_add+0x70/0xa0
? _raw_spin_lock_irqsave+0x19/0x50
? _raw_spin_unlock_irqrestore+0x1b/0x40
? erdma_alloc_idx+0x51/0x90 [erdma]
erdma_get_dma_mr+0xa3/0x120 [erdma]
__ib_alloc_pd+0xeb/0x1c0 [ib_core]
Fixes: 7244b4aa4221 ("RDMA/erdma: Refactor the storage structure of MTT entries")
Reported-by: Dan Carpenter <[email protected]>
Closes: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Cheng Xu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Leon Romanovsky <[email protected]>
Diffstat (limited to 'lib/test_fortify/write_overflow-strncpy-src.c')
0 files changed, 0 insertions, 0 deletions