Thank you Dan for the report.
We will post a fix upstream at the earliest.
On Wed, Sep 25, 2024 at 3:00 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> Hello Chandramohan Akula,
>
> Commit dee3da3422d5 ("RDMA/bnxt_re: Change aux driver data to en_info
> to hold more information") from Sep 10, 2024 (linux-next), leads to
> the following Smatch static checker warning:
>
> drivers/infiniband/hw/bnxt_re/main.c:1875 bnxt_re_add_device()
> error: NULL dereference inside function 'bnxt_re_update_en_info_rdev((0), en_info, adev)()'
>
> drivers/infiniband/hw/bnxt_re/main.c
> 1830 static int bnxt_re_add_device(struct auxiliary_device *adev, u8 op_type)
> 1831 {
> 1832 struct bnxt_aux_priv *aux_priv =
> 1833 container_of(adev, struct bnxt_aux_priv, aux_dev);
> 1834 struct bnxt_re_en_dev_info *en_info;
> 1835 struct bnxt_en_dev *en_dev;
> 1836 struct bnxt_re_dev *rdev;
> 1837 int rc;
> 1838
> 1839 en_info = auxiliary_get_drvdata(adev);
> 1840 en_dev = en_info->en_dev;
> 1841
> 1842
> 1843 rdev = bnxt_re_dev_add(aux_priv, en_dev);
> 1844 if (!rdev || !rdev_to_dev(rdev)) {
> 1845 rc = -ENOMEM;
> 1846 goto exit;
> 1847 }
> 1848
> 1849 bnxt_re_update_en_info_rdev(rdev, en_info, adev);
> 1850
> 1851 rc = bnxt_re_dev_init(rdev, op_type);
> 1852 if (rc)
> 1853 goto re_dev_dealloc;
> 1854
> 1855 rc = bnxt_re_ib_init(rdev);
> 1856 if (rc) {
> 1857 pr_err("Failed to register with IB: %s",
> 1858 aux_priv->aux_dev.name);
> 1859 goto re_dev_uninit;
> 1860 }
> 1861
> 1862 rdev->nb.notifier_call = bnxt_re_netdev_event;
> 1863 rc = register_netdevice_notifier(&rdev->nb);
> 1864 if (rc) {
> 1865 rdev->nb.notifier_call = NULL;
> 1866 pr_err("%s: Cannot register to netdevice_notifier",
> 1867 ROCE_DRV_MODULE_NAME);
> 1868 return rc;
> 1869 }
> 1870 bnxt_re_setup_cc(rdev, true);
> 1871
> 1872 return 0;
> 1873
> 1874 re_dev_uninit:
> --> 1875 bnxt_re_update_en_info_rdev(NULL, en_info, adev);
> ^^^^
> Passing NULL here will lead to a crash.
>
> 1876 bnxt_re_dev_uninit(rdev, BNXT_RE_COMPLETE_REMOVE);
> 1877 re_dev_dealloc:
> 1878 ib_dealloc_device(&rdev->ibdev);
> 1879 exit:
> 1880 return rc;
> 1881 }
>
> regards,
> dan carpenter
>
--
Regards,
Kalesh A P
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
