lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 29 Jun 2017 10:20:57 +0200 From: Andrea Righi <righi.andrea@...il.com> To: Sagi Grimberg <sagi@...mberg.me> Cc: "Nicholas A. Bellinger" <nab@...ux-iscsi.org>, Robert LeBlanc <robert@...lancnet.us>, Sean Jenkins <sean@...terservers.com>, Doug Ledford <dledford@...hat.com>, Sean Hefty <sean.hefty@...el.com>, Hal Rosenstock <hal.rosenstock@...il.com>, linux-rdma <linux-rdma@...r.kernel.org>, target-devel <target-devel@...r.kernel.org>, lkml <linux-kernel@...r.kernel.org>, Christoph Hellwig <hch@....de> Subject: Re: [PATCH] ib_isert: prevent NULL pointer dereference in isert_login_recv_done() On Thu, Jun 29, 2017 at 08:36:51AM +0300, Sagi Grimberg wrote: > > >Just tested this patch, I wasn't able to reproduce the NULL pointer > >dereference or any other bugs, so this fix seems safe enough to me. > > > >Tested-by: Andrea Righi <righi.andrea@...il.com> > > Can you test just the one liner fix below? > > >>@@ -1452,7 +1452,7 @@ > >> isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) > >> { > >> struct isert_conn *isert_conn = wc->qp->qp_context; > >>- struct ib_device *ib_dev = isert_conn->cm_id->device; > >>+ struct ib_device *ib_dev = isert_conn->device->ib_device; > >> if (unlikely(wc->status != IB_WC_SUCCESS)) { > >> isert_print_wc(wc, "login recv"); I'll test also this one-liner fix as soon as I can. But I can say that I'm pretty sure it will work as well, because all the previous NULL pointer dereferences that we've got in the past happened all 100% in isert_login_recv_done(). The other cases are probably a safe precaution, but they can't really happen. -Andrea
Powered by blists - more mailing lists