chcr_ktls: add a defensive NULL check to prevent a possible null-pointer dereference in chcr_ktls_dev_del()

[PATCH] chcr_ktls: add a defensive NULL check to prevent a possible null-pointer dereference in chcr_ktls_dev_del()

Posted by Tuo Li 1 month ago

In this function, u_ctx is guarded by an if statement, which indicates that
it may be NULL:

  u_ctx = tx_info->adap->uld[CXGB4_ULD_KTLS].handle;
  if (u_ctx && u_ctx->detach)
    return;

Consequently, a potential null-pointer dereference may occur when
tx_info->tid != -1, as shown below:

  if (tx_info->tid != -1) {
    ...
    xa_erase(&u_ctx->tid_list, tx_info->tid);
  }

Therefore, add a defensive NULL check to prevent this issue.

Fixes: 65e302a9bd57 ("cxgb4/ch_ktls: Clear resources when pf4 device is removed")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
index 4e2096e49684..79292314a012 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
@@ -389,7 +389,8 @@ static void chcr_ktls_dev_del(struct net_device *netdev,
 		cxgb4_remove_tid(&tx_info->adap->tids, tx_info->tx_chan,
 				 tx_info->tid, tx_info->ip_family);
 
-		xa_erase(&u_ctx->tid_list, tx_info->tid);
+		if (u_ctx)
+			xa_erase(&u_ctx->tid_list, tx_info->tid);
 	}
 
 	port_stats = &tx_info->adap->ch_ktls_stats.ktls_port[tx_info->port_id];
-- 
2.43.0

Re: [PATCH] chcr_ktls: add a defensive NULL check to prevent a possible null-pointer dereference in chcr_ktls_dev_del()

Posted by Jakub Kicinski 4 weeks, 1 day ago

On Tue,  6 Jan 2026 20:33:02 +0800 Tuo Li wrote:
> In this function, u_ctx is guarded by an if statement, which indicates that
> it may be NULL:
> 
>   u_ctx = tx_info->adap->uld[CXGB4_ULD_KTLS].handle;
>   if (u_ctx && u_ctx->detach)
>     return;
> 
> Consequently, a potential null-pointer dereference may occur when
> tx_info->tid != -1, as shown below:
> 
>   if (tx_info->tid != -1) {
>     ...
>     xa_erase(&u_ctx->tid_list, tx_info->tid);
>   }
> 
> Therefore, add a defensive NULL check to prevent this issue.

There seems to be no locking here.
It'd take much more to make this code safe, sprinking random ifs
here and there seem like a waste of time.
-- 
pw-bot: reject

Re: [PATCH] chcr_ktls: add a defensive NULL check to prevent a possible null-pointer dereference in chcr_ktls_dev_del()

Posted by Tuo Li 3 weeks, 5 days ago

Hi Jakub

On Fri, Jan 9, 2026 at 9:53 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue,  6 Jan 2026 20:33:02 +0800 Tuo Li wrote:
> > In this function, u_ctx is guarded by an if statement, which indicates that
> > it may be NULL:
> >
> >   u_ctx = tx_info->adap->uld[CXGB4_ULD_KTLS].handle;
> >   if (u_ctx && u_ctx->detach)
> >     return;
> >
> > Consequently, a potential null-pointer dereference may occur when
> > tx_info->tid != -1, as shown below:
> >
> >   if (tx_info->tid != -1) {
> >     ...
> >     xa_erase(&u_ctx->tid_list, tx_info->tid);
> >   }
> >
> > Therefore, add a defensive NULL check to prevent this issue.
>
> There seems to be no locking here.
> It'd take much more to make this code safe, sprinking random ifs
> here and there seem like a waste of time.

Thanks for pointing this out.

Given the lack of proper locking here, I'd rather drop this patch than add
ad-hoc NULL checks.

Thanks for the review,
Tuo