Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit a09fb34

Browse files
committedJun 6, 2025
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
jira LE-3201 cve CVE-2022-48773 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 commit-author Dan Aloni <[email protected]> commit a9c10b5 If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries free them, resulting in an Oops. Signed-off-by: Dan Aloni <[email protected]> Acked-by: Chuck Lever <[email protected]> Signed-off-by: Anna Schumaker <[email protected]> (cherry picked from commit a9c10b5) Signed-off-by: Jonathan Maple <[email protected]>
1 parent f8ac924 commit a09fb34

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed
 

‎net/sunrpc/xprtrdma/verbs.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
436436
IB_POLL_WORKQUEUE);
437437
if (IS_ERR(ep->re_attr.send_cq)) {
438438
rc = PTR_ERR(ep->re_attr.send_cq);
439+
ep->re_attr.send_cq = NULL;
439440
goto out_destroy;
440441
}
441442

@@ -444,6 +445,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
444445
IB_POLL_WORKQUEUE);
445446
if (IS_ERR(ep->re_attr.recv_cq)) {
446447
rc = PTR_ERR(ep->re_attr.recv_cq);
448+
ep->re_attr.recv_cq = NULL;
447449
goto out_destroy;
448450
}
449451
ep->re_receive_count = 0;
@@ -482,6 +484,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
482484
ep->re_pd = ib_alloc_pd(device, 0);
483485
if (IS_ERR(ep->re_pd)) {
484486
rc = PTR_ERR(ep->re_pd);
487+
ep->re_pd = NULL;
485488
goto out_destroy;
486489
}
487490

0 commit comments

Comments
 (0)
Please sign in to comment.