• Jack Morgenstein's avatar
    IB/core: Fix potential NULL pointer dereference in pkey cache · 1901b91f
    Jack Morgenstein authored
    The IB core pkey cache is populated by procedure ib_cache_update().
    Initially, the pkey cache pointer is NULL. ib_cache_update allocates a
    buffer and populates it with the device's pkeys, via repeated calls to
    procedure ib_query_pkey().
    
    If there is a failure in populating the pkey buffer via ib_query_pkey(),
    ib_cache_update does not replace the old pkey buffer cache with the
    updated one -- it leaves the old cache as is.
    
    Since initially the pkey buffer cache is NULL, when calling
    ib_cache_update the first time, a failure in ib_query_pkey() will cause
    the pkey buffer cache pointer to remain NULL.
    
    In this situation, any calls subsequent to ib_get_cached_pkey(),
    ib_find_cached_pkey(), or ib_find_cached_pkey_exact() will try to
    dereference the NULL pkey cache pointer, causing a kernel panic.
    
    Fix this by checking the ib_cache_update() return value.
    
    Fixes: 8faea9fd ("RDMA/cache: Move the cache per-port data into the main ib_port_data")
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Link: https://lore.kernel.org/r/20200507071012.100594-1-leon@kernel.orgSigned-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    1901b91f
cache.c 40.5 KB