linux-kernel - [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251112074513.63321-1-islituo@gmail.com>
Date: Wed, 12 Nov 2025 15:45:12 +0800
From: Tuo Li <islituo@...il.com>
To: krzysztof.czurylo@...el.com,
	tatyana.e.nikolova@...el.com,
	jgg@...pe.ca,
	leon@...nel.org
Cc: linux-rdma@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Tuo Li <islituo@...il.com>
Subject: [PATCH] RDMA/irdma: Fix possible null-pointer dereference in irdma_create_user_ah()

The variable udata is checked at the beginning of irdma_create_user_as(),
indicating that it can be NULL:

  if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
    return -EINVAL;

However, if udata is NULL, a null-pointer dereference may occur when
calling ib_copy_to_udata():

  err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));

To prevent this possible null-pointer dereference, add a NULL check for
udata before calling ib_copy_to_udata().

Signed-off-by: Tuo Li <islituo@...il.com>
---
 drivers/infiniband/hw/irdma/verbs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c883c9ea5a83..01eccbbb9600 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -5233,7 +5233,8 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
 	mutex_unlock(&iwdev->rf->ah_tbl_lock);
 
 	uresp.ah_id = ah->sc_ah.ah_info.ah_idx;
-	err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
+	if (udata)
+		err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
 	if (err)
 		irdma_destroy_ah(ibah, attr->flags);
 
-- 
2.43.0