Re: [PATCH] IB/mlx5: Fix potential NULL dereference in query_device

[Prathamesh Deshpande]

On Tue, Mar 31, 2026 at 04:49:55PM +0300, Leon Romanovsky wrote:
> On Tue, Mar 31, 2026 at 02:44:27AM +0100, Prathamesh Deshpande wrote:
> > Smatch reported an inconsistent NULL check for 'uhw' in
> > mlx5_ib_query_device(). While 'uhw_outlen' is checked at the end of
> > the function before calling ib_copy_to_udata(), 'uhw' is explicitly
> > checked for NULL earlier in the same function.
> >
> > If a caller provides a non-zero 'uhw_outlen' but a NULL 'uhw' pointer,
> > ib_copy_to_udata() will attempt to dereference 'uhw',
>
> How is it possible?

Hi Leon,

You are right that in the current uverbs paths, 'uhw_outlen' and 'uhw'
should stay in sync.

However, Smatch flags this as an inconsistency because 'uhw' is explicitly
checked for NULL earlier in this same function (at line 968). If the code
assumes 'uhw' could be NULL there, it is safer and more consistent to
check the pointer directly before passing it to ib_copy_to_udata() at
line 1357.

This prevents any future refactoring or unconventional kernel-space
callers from accidentally triggering a NULL dereference.

What do you think?

Thanks,
Prathamesh