]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
authorChen Zhongjin <chenzhongjin@huawei.com>
Tue, 25 Oct 2022 02:41:46 +0000 (10:41 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Nov 2022 16:57:50 +0000 (17:57 +0100)
commit2267d3ee207ba5f942efb8be62441d7de1bbcf13
tree18e3d577bf10e10bc459c13cf93a4ca6c1afcbb1
parentb794729d50a8ed11dee8079f8bdc3befd8883e4d
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()

[ Upstream commit bc74dda8bf7299ce7e77e86403f11beee408e3bc ]

KASAN reported a null-ptr-deref error:

  KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
  CPU: 1 PID: 379
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: 0010:destroy_workqueue+0x2f/0x740
  RSP: 0018:ffff888016137df8 EFLAGS: 00000202
  ...
  Call Trace:
   ib_core_cleanup+0xa/0xa1 [ib_core]
   __do_sys_delete_module.constprop.0+0x34f/0x5b0
   do_syscall_64+0x3a/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7fa1a0d221b7
  ...

It is because the fail of roce_gid_mgmt_init() is ignored:

 ib_core_init()
   roce_gid_mgmt_init()
     gid_cache_wq = alloc_ordered_workqueue # fail
 ...
 ib_core_cleanup()
   roce_gid_mgmt_cleanup()
     destroy_workqueue(gid_cache_wq)
     # destroy an unallocated wq

Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().

Fixes: 7c8ac3881011 ("IB/core: Add RoCE GID table management")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Link: https://lore.kernel.org/r/20221025024146.109137-1-chenzhongjin@huawei.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/core/device.c
drivers/infiniband/core/nldev.c