net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()

karstengr · kuba-moo · commit d22f4f977236 · 2022-04-11T18:28:03.000-07:00
dev_name() was called with dev.parent as argument but without to NULL-check it before. Solve this by checking the pointer before the call to dev_name(). Fixes: af5f60c ("net/smc: allow PCI IDs as ib device names in the pnet table") Reported-by: syzbot+03e3e228510223dabd34@syzkaller.appspotmail.com Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
@@ -311,8 +311,9 @@ static struct smc_ib_device *smc_pnet_find_ib(char *ib_name)
 	list_for_each_entry(ibdev, &smc_ib_devices.list, list) {
 		if (!strncmp(ibdev->ibdev->name, ib_name,
 			     sizeof(ibdev->ibdev->name)) ||
-		    !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name,
-			     IB_DEVICE_NAME_MAX - 1)) {
+		    (ibdev->ibdev->dev.parent &&
+		     !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name,
+			     IB_DEVICE_NAME_MAX - 1))) {
 			goto out;
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -311,8 +311,9 @@ static struct smc_ib_device smc_pnet_find_ib(char ib_name)`
`311`	`311`	`list_for_each_entry(ibdev, &smc_ib_devices.list, list) {`
`312`	`312`	`if (!strncmp(ibdev->ibdev->name, ib_name,`
`313`	`313`	`sizeof(ibdev->ibdev->name)) \|\|`
`314`		`- !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name,`
`315`		`- IB_DEVICE_NAME_MAX - 1)) {`
	`314`	`+ (ibdev->ibdev->dev.parent &&`
	`315`	`+ !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name,`
	`316`	`+ IB_DEVICE_NAME_MAX - 1))) {`
`316`	`317`	`goto out;`
`317`	`318`	`}`
`318`	`319`	`}`