From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f50.google.com (mail-ej1-f50.google.com [209.85.218.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 505033750D5 for ; Mon, 24 Aug 2026 03:30:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.218.50 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787542214; cv=pass; b=TGvCeU36wKZA1saz6IOH+0ztzqqoZiAVv52S84AvuBviebQdAhyYDn2VljZeIxcwuasoOUhjfTgBUwLB6/S4JfbD5KsKMeSjSapDDJAEyjS7aGvHJyhdd9JaQWrh2YHexZjjG1vU8uMfXyo1LQ1c5tViK3P+s0+q4qjnjpc2lPw= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787542214; c=relaxed/simple; bh=+nzZ6tdJPSH4n79gvadSJGNV7wbriV2ZXJzPTGvymEM=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=CkIUh0lIawfvWHYWL/1qstTkEydNGl+pRVdIc2qr918Rvax3JT+tPF4yD3A1hv9A/uBiGMosgefiKZiI8PDU+Z9n4SYu6lB0A/jg42zNyoad186hdubvDb2EcDDSFQ+obKoNDWqlxAfSn42HPUkB6emM3EX2z5GLXHa++FP10K8= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cloud.ionos.com; spf=pass smtp.mailfrom=ionos.com; dkim=pass (2048-bit key) header.d=cloud.ionos.com header.i=@cloud.ionos.com header.b=gQ3xucZg; arc=pass smtp.client-ip=209.85.218.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cloud.ionos.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ionos.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloud.ionos.com header.i=@cloud.ionos.com header.b="gQ3xucZg" Received: by mail-ej1-f50.google.com with SMTP id a640c23a62f3a-c15f025146dso38901966b.2 for ; Sun, 23 Aug 2026 20:30:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787542209; cv=none; d=google.com; s=arc-20260327; b=ptmxOneprFaDBXWX1rPcbVBsP7FfV/1tlwlOcX2o1k1Tes9gueq+okvqeYAV2b86Jp KzXC6r9X+yzmLWV6KJ2hB5WEp55YlBcxXPVT6zK08WgZqgB1sbg08XflVYaezRPGplOB yDG8+dVWgWOCptMbHdB+mKKo2ezm8Zt0Wc1CjHN9xbTkS/xwv4lUlPSbyirGKZgTbFeI mEQVxb49P5Hx/jqlRLrnqx3dTEvVTSPfjE3wcH26Da9s03eoj8Eg9og/0KoIS+7tIy3i B3e8aK+ADzIaMz5zVdV2txmZvxBAtiNHbRzJxrJ9iYN4Z+aKg8jUwyiTISzYFroCytlN 2RFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=LLwzd8NaHrfcJF+QUosyNveH08w9wJnwsgT0VI4vxL4=; fh=7txOK8PgIS/oMrSN+acleewrToT0mn/UE1+bYTQ2kW8=; b=qcw9lufy5uaUBucV2gqynOfU0rpRKVsvim2m4XeRg8+RUJ/yefopi4s7UU7Jph5r9W O49K9k+qmS6YdTIuzZGLUEV95/Z9ULHhFSgSLWUQs0N1OJbIA+qaa+pYgukheIByZ5bT 6NRGruDCSndm2CWpJzBCGE2NOEL4QyS8+NFJEbtawizziQtzXxeNjOVVEz+6RA7LuH+h IU5236ueRTT9gbUGQPCN9XBP/Ew0nzYJhFTxIxOVpNcZlU4KtrSTzZlqJD/GC/onMEY5 Y+lHAxNxDk+cEr7hZA8Vefe3f32Xj5Xt7qxGofC7JZZmzrQWZWiMMeY4UvMhFqiGIsJ3 6pOw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloud.ionos.com; s=google; t=1787542209; x=1788147009; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=LLwzd8NaHrfcJF+QUosyNveH08w9wJnwsgT0VI4vxL4=; b=gQ3xucZgvygqSOw52sLE9pJtIxv7NpkkIu50B7T0MYk4HCzArm7STfYVpIror0D6c6 oSFRJGDYQ2g+2h0kyOCpQp4wQl2zTpGf0ttxKgguBZ59HTzQldKu2rMC/HLdRcPimZ4S T6e+tvfa05r4Ep0T1TJqKHXoCClBFO4vqIOh3EiNZNNJXaUyb7og14+syBVjPwegJFVO CUHCd3bhpB4zSfBi2wzXr4CRkRV8WGxEj7gESVJEAkIm7lpeKJiQKeM2Xfs09eNMx/bl oXIjiIjLJQIPIHVHMYcRnDrLayqcsiPp1dm2G1gLBBwzUyf9UdDwqSveQ4CyY8UrikJC rmQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787542209; x=1788147009; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=LLwzd8NaHrfcJF+QUosyNveH08w9wJnwsgT0VI4vxL4=; b=SJg3CpB1QNwOugQ/Ppgors+E4WYLx2ll8BHm+oiUsrdjgW7QG382Q5NFOYANpkOWpT u69WLOTZJxnBwHXnKoAFHU7LW8lrF7IyejpSs5swcniIWdR07ox871C7F9g4eXmZDuTE fBK0NEml7Lplb8h08lhYg8vh/jQPMr2UZOrdyyl+6XfBOAsV1Wr9ITovwq98JAcY9T2f vJ/6cHz1lWukiQFb7F2I1XyBKrYq1vN+EvxVnPWXstLhWgUarVYJ5+TqBc7tcTadFg2b Wxfjr4t1KqGreDbDJzfsrT/3LJc+Ea+CU9jqV1oCn974cEoACDIXv11gFNuJbUKwTWyE RA+w== X-Forwarded-Encrypted: i=1; AHgh+RoyRV17t6/ILm37tdEA+1jApEdKcwLb+bOaW1fYF6qGnlVgEJ+w8KeO6eyOEXc++yq0GSoWVA4UWEgKcLg=@vger.kernel.org X-Gm-Message-State: AFuF++mz3bgA4HmpY3BipWd4YDzyjjVrH/+o1e3hxmVoNVPCSGabblSB yZRYwA/T59JCEQNrytRK7t2zDG4qer/84mQM3s0CyTOcyyc6F6g2eXDOO5bryP7yA9ZRDryy68h YTD5RwH8qe9Q0pr6h4B4ygUDqyy6OtG21ubQ9IGAqyw== X-Gm-Gg: AR+sD112yBlRKaONci/dqURPG/1SabJ1IN5gR1pjFeI96brMijj04ZqO46Fy2bJFUfQ GCsSYb9UP5IZX1gyZ2yGCRRb7zRPq6pLijdEKB+MqXdxMUUD+ZAp6X/iysXzm1o+lri3bCYWBWM gut2uDO8zENyUGUqkrzVylwt5PLtFRXDDhyo1I2rSX2aOUfrjjhMVvk0t/WD+ZxYrqfzG9zCcMa +0j7SrvLcgiJODxR1BeX23VzogCll2rpM5cv7zbOG3TdSPXQZYwV27ZBDe/oBqvINcGPoRfNCgZ b3p82Dl74p0ot3cPIOaPAVHmEA7SjGQo1d4zyXwnvdUttW+XFGMpYHVE6UIWFzUaJv4MH5FA+Vl A X-Received: by 2002:a17:907:2951:b0:c24:908b:4e2e with SMTP id a640c23a62f3a-c24908b53c9mr596750366b.4.1787542209350; Sun, 23 Aug 2026 20:30:09 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260823034303.163403-1-ryan.mehri1@gmail.com> In-Reply-To: <20260823034303.163403-1-ryan.mehri1@gmail.com> From: Jinpu Wang Date: Mon, 24 Aug 2026 05:29:56 +0200 X-Gm-Features: AcwNN1U-n-zUy07z8ztf_sz5VKy4Q0hIyyQkaioNJ_TzpW8wQ8zaTIOvGDpxLS0 Message-ID: Subject: Re: [PATCH] RDMA/rtrs: guard against null kobj name To: Ryan Mehri Cc: haris.iqbal@ionos.com, jgg@ziepe.ca, leon@kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+1695193198994f4e7fed@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Aug 23, 2026 at 5:43=E2=80=AFAM Ryan Mehri = wrote: > > In the client, if `init_path()` errors, the callee tries to clean up > with `rtrs_clt_close_conns()`. However, this can lead to calling the > event tracing code with `clt_path->kobj->name` being `NULL` and thus > causing a null pointer dereference when trying to copy from it. > > This just adds a guard to check that the name is not `NULL` before > copying from it. The server appears to have a similar pattern. > > Fixes: 5a93929d9f9a1 ("RDMA/rtrs-clt: Add event tracing support") > Fixes: c16762b7bf54d ("RDMA/rtrs-srv: Add event tracing support") > Reported-by: syzbot+1695193198994f4e7fed@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=3D1695193198994f4e7fed > Signed-off-by: Ryan Mehri lgtm, thx! Reviewed-by: Jack Wang > --- > drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h | 2 +- > drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h b/drivers/infin= iband/ulp/rtrs/rtrs-clt-trace.h > index 7738e2676855..29e23404bb7b 100644 > --- a/drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h > +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h > @@ -55,7 +55,7 @@ DECLARE_EVENT_CLASS(rtrs_clt_conn_class, > __entry->max_reconnect_attempts =3D clt->max_reconnect_at= tempts; > __entry->fail_cnt =3D clt_path->stats->reconnects.fail_cn= t; > __entry->success_cnt =3D clt_path->stats->reconnects.succ= essful_cnt; > - memcpy(__entry->sessname, kobject_name(&clt_path->kobj), = NAME_MAX); > + strscpy(__entry->sessname, kobject_name(&clt_path->kobj) = ?: "", NAME_MAX); > ), > > TP_printk("RTRS-CLT: sess=3D'%s' state=3D%s attempts=3D'%d' max-a= ttempts=3D'%d' fail=3D'%d' success=3D'%d'", > diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h b/drivers/infin= iband/ulp/rtrs/rtrs-srv-trace.h > index 587d3e033081..a7d7b971e6c8 100644 > --- a/drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h > +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h > @@ -61,7 +61,7 @@ TRACE_EVENT(send_io_resp_imm, > __entry->msg_id =3D id->msg_id; > __entry->wr_cnt =3D atomic_read(&con->c.wr_cnt); > __entry->signal_interval =3D s->signal_interval; > - memcpy(__entry->sessname, kobject_name(&srv_path->kobj), = NAME_MAX); > + strscpy(__entry->sessname, kobject_name(&srv_path->kobj) = ?: "", NAME_MAX); > ), > > TP_printk("sess=3D'%s' state=3D'%s' dir=3D%s err=3D'%d' inval=3D'= %d' glob-inval=3D'%d' msgid=3D'%u' wrcnt=3D'%d' sig-interval=3D'%u'", > -- > 2.55.0 >