Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present. KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50
Product status
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before ab61841633d10e56a58c1493a262f0d02dba2f5e
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before 8564dcc12fbb372d984ab45768cae9335777b274
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before ab957056192d6bd068b3759cb2077d859cca01f0
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before ffba40b67663567481fa8a1ed5d2da36897c175d
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before 87b7a036d2c73d5bb3ae2d47dee23de465db3355
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before 714c99e1dc8f85f446e05be02ba83972e981a817
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before ce025f7f5d070596194315eb2e4e89d568b8a755
8b6a361b8c482f22ac99c3273285ff16b23fba91 (git) before 14ab3da122bd18920ad57428f6cf4fade8385142
5.3
Any version before 5.3
5.10.252 (semver)
5.15.202 (semver)
6.1.165 (semver)
6.6.128 (semver)
6.12.75 (semver)
6.18.14 (semver)
6.19.4 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/ab61841633d10e56a58c1493a262f0d02dba2f5e
git.kernel.org/...c/8564dcc12fbb372d984ab45768cae9335777b274
git.kernel.org/...c/ab957056192d6bd068b3759cb2077d859cca01f0
git.kernel.org/...c/ffba40b67663567481fa8a1ed5d2da36897c175d
git.kernel.org/...c/87b7a036d2c73d5bb3ae2d47dee23de465db3355
git.kernel.org/...c/714c99e1dc8f85f446e05be02ba83972e981a817
git.kernel.org/...c/ce025f7f5d070596194315eb2e4e89d568b8a755
git.kernel.org/...c/14ab3da122bd18920ad57428f6cf4fade8385142