Re: [PATCH] IB/usnic: fix wild pointer dereference in usnic_ib_qp_grp_dump_rows()

[Leon Romanovsky]

On Fri, 23 Oct 2026 15:33:49 +0800, Li Ximo wrote:
> While auditing list_first_entry() users we found that
> usnic_ib_qp_grp_dump_rows() calls list_first_entry() on
> qp_grp->flows_lst without checking whether the list is empty.
> list_first_entry() never returns NULL: on an empty list head->next ==
> head, so container_of() yields a bogus non-NULL pointer derived from
> the list head address. The function then dereferences it twice through
> "default_flow->flow->flow_id", which reads a garbage pointer out of
> the enclosing structure and dereferences that in turn, almost
> certainly causing a kernel oops.
> 
> [...]

Applied, thanks!

[1/1] IB/usnic: fix wild pointer dereference in usnic_ib_qp_grp_dump_rows()
      https://git.kernel.org/rdma/rdma/c/289ea23b7bdeea

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>