Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a50881b authored by Moni Shoua's avatar Moni Shoua Committed by Jason Gunthorpe
Browse files

IB/core: Verify that QP is security enabled in create and destroy 



The XRC target QP create flow sets up qp_sec only if there is an IB link with
LSM security enabled. However, several other related uAPI entry points blindly
follow the qp_sec NULL pointer, resulting in a possible oops.

Check for NULL before using qp_sec.

Cc: <stable@vger.kernel.org> # v4.12
Fixes: d291f1a6 ("IB/core: Enforce PKey security on QPs")
Reviewed-by: default avatarDaniel Jurgens <danielj@mellanox.com>
Signed-off-by: default avatarMoni Shoua <monis@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 05d14e7b

drivers/infiniband/core/security.c

+3 −0
Original line number Diff line number Diff line
@@ -386,6 +386,9 @@ int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev) 
	if (ret)

		return ret;



	if (!qp->qp_sec)

		return 0;



	mutex_lock(&real_qp->qp_sec->mutex);

	ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,

					  qp->qp_sec);

drivers/infiniband/core/verbs.c

+2 −1
Original line number Diff line number Diff line
@@ -1438,6 +1438,7 @@ int ib_close_qp(struct ib_qp *qp) 
	spin_unlock_irqrestore(&real_qp->device->event_handler_lock, flags);



	atomic_dec(&real_qp->usecnt);

	if (qp->qp_sec)

		ib_close_shared_qp_security(qp->qp_sec);

	kfree(qp);