From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECF893CFF6C for ; Mon, 24 Aug 2026 11:17:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787570228; cv=none; b=YBg1nzAp+kHVpGD6hY/UFJMW8tyZIYuPcqLI31dVkRuShPZ3P7bLBp8nENLSOfT97cX0esIg9EgsBUL9kP7XygpUBiMLT2R3ZgMVRiKdNS1GfwKTZbZfocWy0Z5IO/EMw/RgTUPlUQCoVPlZPkmGYK12P7/ZfOzwd5rSLhCVZmM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787570228; c=relaxed/simple; bh=h84y8IY73k8HDgDFbEOYAH4dnXdhVJJgku0CDx6klyE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hs6ILiZoQDLT+nHF9sZdPyFeV7Cv3IorTTpftnUEnkrRGDS6aqn2IXP305i8wBz0ufmTTVIU0mmKVLwVBt1K40ORolWasDQ3yrsPZU8p52eEJEk0HpDgVcyZwSs/uLES3OZ8GtwIVuDEaniKGK5K5r+SJph1VAOjm5NJyTixmXA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=R0ZDX0v2; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="R0ZDX0v2" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-381b831d535so4755325a91.0 for ; Mon, 24 Aug 2026 04:17:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787570226; x=1788175026; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=AWFyETnr9mq+FduhbKFRct19A7NzPMjqIJldSASGEJw=; b=R0ZDX0v2O7+AAunwhoulRU+ABxtj9hYPybsqIGu59n0/hAKF+qzgev2pzm+00awCvp g3WlQIi+mGFMRazzLFoVE4TU2HWzX8Qzr9dQHy+A1uxXedzQiX4iuWMM+oWf0vtlKKQd Loj89xjBpq4SN1GDBj9dqrpvqWp3ntStd8+PEETJKHXttVjq4QJVaVCbMcIwGD3LV7oR ujPW/ffEi+1ek9eDYEOM1vHSbsQFJATp8bVZremwEQXhAvdYHXGP5X4Of6SbhY3zhlBO 1NGBtLOViNuaBZ4/kv4459BnS4b2Eifjr3T1Cij3f/6a758urDabhuCa4+g1/oZAywwT DQZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787570226; x=1788175026; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AWFyETnr9mq+FduhbKFRct19A7NzPMjqIJldSASGEJw=; b=aoTrPN+xVqD9ktGnQHIxgjJ+7QeCNSjotAERt64gGEtdEymgE+lFsU3QknQig7aUQ+ BLB7m8yWzDhpso6kscXu/R0dsNcp+gOjjhCg53W4fNFgFVubHmsB+XSDB3+6xaUMg7I8 lx9FI9myBEOXujyLownmKvDR3stz8t+4jlH2I+u3cIm9vFsi99ncRx+cZVpBWwpKrgZ0 fy0zcgij4DdYPDJSkujI+e2cS1Lg1qLkyMEJQZV1O3/8Lt4ivqHK72IuDawqQwan8ufE 2Dr+QmFbJWWgKzgkcnWiLBlaa1EZD0WcOFZ3F9w/UvjHncXScZ7pbLzS/FkhJnkYAivZ HlUg== X-Forwarded-Encrypted: i=1; AHgh+RqKMGcAujN0nRw/Eb4HaH90QOVM8fda8MW4c63WExTNIt3X9Ml1Lu4i599RCSgzoFAYaaEf5ZElFReSQMA=@vger.kernel.org X-Gm-Message-State: AFuF++mhO2UrtzgoNaM/oX8DLpajwWNRAo7vemZ/sX44fplGfhLnRApe WqDYNh1S5bEMVKcV44wlyq+Cpo03AjNfOKFqiFUBULSN6ZXnPqlQMfRJ X-Gm-Gg: AR+sD12ZEhj++YEyHTatnPoGUAmI67ko1UWozWSHEowDZNCpFntzZqt5cB9DgFzPK5W Z0KeyrK3f5wS4TUKieoKnboXZCpYGo6tiWLkaQ+fhOIKgd0WerYgyW7ojgNmTHe5AIi1xNnbMIm aCRYKtL+YP5jOP/M6ysxNg0jCQNFyTa26nvRsLo0HjagdhKlb4NmlAuQV7Qvki9EGQ1SOtvZN2x lJtdilUjSQ5M+/xvKY3rkapmqIn8xVUZjlNlPeDCCh5Q8h2R96EuSZVEPhbeUXzgRK2lctqfwHJ zcpndzLbUcmdEb4yC9smX6DT6fjdmvoqygEqMQPzsngcN+P83Ylou7tU/wFjtPmiO6uN0/egXGI Wy+Fbo7clpWKDLJlp74+rxfhg88kzC5uWI9yHhZ/N3WwJSHvB16+QkHN4UK5PNFS9l0d2zVbtM9 cHw/BbMp6acHFCKSBpqhrDcvvamYpcstb3vKYX39acxlBORC/J60pzHuHNJB7wrje0URCr3Bar5 EWS+wqUmyWA9Vvpty/Num3p+hU= X-Received: by 2002:a17:90b:4a81:b0:38e:6f90:eabd with SMTP id 98e67ed59e1d1-395c355c570mr44450182a91.5.1787570226249; Mon, 24 Aug 2026 04:17:06 -0700 (PDT) Received: from localhost.localdomain ([180.101.244.72]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-395e4996691sm9650165a91.6.2026.08.24.04.17.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 04:17:05 -0700 (PDT) From: Aohan Mei To: netdev@vger.kernel.org Cc: Allison Henderson , linux-rdma@vger.kernel.org, rds-devel@oss.oracle.com, linux-kernel@vger.kernel.org, Jason Xing , Aohan Mei , TencentOS Corvus AI , stable@vger.kernel.org Subject: [PATCH net] net: rds: fix uninitialized trans dereference in CM event handler Date: Mon, 24 Aug 2026 19:17:01 +0800 Message-ID: <20260824111701.2979194-1-ljp1205831794@gmail.com> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Aohan Mei rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(), and (with a connection context) in the ROUTE_RESOLVED and ESTABLISHED cases. An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm_handle_connect) in the iw_cm_wq workqueue. GCC masks the bug in default builds by folding the uninitialized load into &rds_ib_transport; Clang-built kernels take the real uninitialized path and oops. Reject events that arrive on device types without an RDS transport: initialize trans to NULL and bail out before the event switch when no transport matched. Fixes: dcdede0406d3 ("RDS: Drop stale iWARP RDMA transport") Reported-by: TencentOS Corvus AI Cc: stable@vger.kernel.org Assisted-by: CodeBuddy:Kimi-K3 Signed-off-by: Aohan Mei --- net/rds/rdma_transport.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index b15cf316b23a..ad9244a09848 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -52,7 +52,7 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, { /* this can be null in the listening path */ struct rds_connection *conn = cm_id->context; - struct rds_transport *trans; + struct rds_transport *trans = NULL; int ret = 0; int *err; u8 len; @@ -80,6 +80,14 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, } } + /* No RDS transport exists for this device type (e.g. iWARP RNIC), + * so trans was never assigned; reject instead of dereferencing it. + */ + if (!trans) { + ret = 1; + goto out; + } + switch (event->event) { case RDMA_CM_EVENT_CONNECT_REQUEST: ret = trans->cm_handle_connect(cm_id, event, isv6); -- 2.43.7