The variable udata is checked at the beginning of irdma_create_user_as(),
indicating that it can be NULL:

  if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
    return -EINVAL;

However, if udata is NULL, a null-pointer dereference may occur when
calling ib_copy_to_udata():

  err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));

To prevent this possible null-pointer dereference, add a NULL check for
udata before calling ib_copy_to_udata().

Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/infiniband/hw/irdma/verbs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c883c9ea5a83..01eccbbb9600 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -5233,7 +5233,8 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
 	mutex_unlock(&iwdev->rf->ah_tbl_lock);
 
 	uresp.ah_id = ah->sc_ah.ah_info.ah_idx;
-	err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
+	if (udata)
+		err = ib_copy_to_udata(udata, &uresp, min(sizeof(uresp), udata->outlen));
 	if (err)
 		irdma_destroy_ah(ibah, attr->flags);
 
-- 
2.43.0

On Wed, Nov 12, 2025 at 03:45:12PM +0800, Tuo Li wrote:
> The variable udata is checked at the beginning of irdma_create_user_as(),
> indicating that it can be NULL:
> 
>   if (udata && udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
>     return -EINVAL;

Just delete "udata" check from this if(). irdma_create_user_ah() always
receives udate.

Thanks