linux-kernel - [PATCH for-next 13/20] IB/hns: Add check for some NULL pointer scenes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Sep 2016 18:30:44 +0800
From:   Salil Mehta <salil.mehta@...wei.com>
To:     <dledford@...hat.com>
CC:     <salil.mehta@...wei.com>, <xavier.huwei@...wei.com>,
        <oulijun@...wei.com>, <yisen.zhuang@...wei.com>,
        <xuwei5@...ilicon.com>, <mehta.salil.lnk@...il.com>,
        <linux-rdma@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linuxarm@...wei.com>,
        "Dongdong Huang(Donald)" <hdd.huang@...wei.com>
Subject: [PATCH for-next 13/20] IB/hns: Add check for some NULL pointer scenes

From: Lijun Ou <oulijun@...wei.com>

Some pointers have not be checked when they are null,
so we add check for them.

Signed-off-by: Lijun Ou <oulijun@...wei.com>
Signed-off-by: Dongdong Huang(Donald) <hdd.huang@...wei.com>
Reviewed-by:  Wei Hu (Xavier) <xavier.huwei@...wei.com>
Signed-off-by: Salil Mehta <salil.mehta@...wei.com>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v1.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index f0d6315..e3e154c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -92,6 +92,12 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 		}
 
 		wqe = get_send_wqe(qp, ind & (qp->sq.wqe_cnt - 1));
+		if (unlikely(!wqe)) {
+			dev_err(dev, "get send wqe failed\n");
+			ret = -EINVAL;
+			*bad_wr = wr;
+			goto out;
+		}
 		qp->sq.wrid[(qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1)] =
 								      wr->wr_id;
 
@@ -1558,6 +1564,11 @@ static int hns_roce_v1_poll_one(struct hns_roce_cq *hr_cq,
 		sq_wqe = get_send_wqe(*cur_qp, roce_get_field(cqe->cqe_byte_4,
 						CQE_BYTE_4_WQE_INDEX_M,
 						CQE_BYTE_4_WQE_INDEX_S));
+		if (unlikely(!sq_wqe)) {
+			dev_err(dev, "Get send wqe failed!\n");
+			return -EFAULT;
+		}
+
 		switch (sq_wqe->flag & HNS_ROCE_WQE_OPCODE_MASK) {
 		case HNS_ROCE_WQE_OPCODE_SEND:
 			wc->opcode = IB_WC_SEND;
-- 
1.7.9.5