CVE-2022-50135

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxeqpdo_cleanup

The function rxecreateqp calls rxeqpfrominit. If some error occurs, the error handler of function rxeqpfrominit will set both scq and rcq to NULL.

Then rxecreateqp calls rxeput to handle qp. In the end, rxeqpdocleanup is called by rxeput. rxeqpdocleanup directly accesses scq and rcq before checking them. This will cause null-ptr-deref error.

The call graph is as below:

rxecreateqp { ... rxeqpfrom_init { ... err1: ... qp->rcq = NULL; <---rcq is set to NULL qp->scq = NULL; <---scq is set to NULL ... }

qpinit: rxeput{ ... rxeqpdocleanup { ... atomicdec(&qp->scq->numwq); <--- scq is accessed ... atomicdec(&qp->rcq->num_wq); <--- rcq is accessed } }