diff options
author | Majd Dibbiny <majd@mellanox.com> | 2016-01-28 10:51:48 -0500 |
---|---|---|
committer | Doug Ledford <dledford@redhat.com> | 2016-02-02 16:42:22 -0500 |
commit | 09f16cf59fbf825130c216c3af189253505dc9d9 (patch) | |
tree | 83eaf9e7dd41596bc83285d9bbfb9ece5a64339b | |
parent | a168a41c8147fe644f1144031a6ec27a1a13fe37 (diff) |
IB/mlx5: Fix use of null pointer PD
When a Raw Ethernet QP is created, a NULL pointer PD could be used.
Fixing that by only using the PD after validating it's valid.
smatch also reported this error:
drivers/infiniband/hw/mlx5/qp.c:1629 mlx5_ib_create_qp()
error: we previously assumed 'pd' could be null (see line 1616)
Fixes: 0fb2ed66a14c ('IB/mlx5: Add create and destroy functionality for Raw Packet QP')
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
-rw-r--r-- | drivers/infiniband/hw/mlx5/qp.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index 8fb9c27485e1..40bbe962a1ce 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c | |||
@@ -1615,15 +1615,6 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, | |||
1615 | 1615 | ||
1616 | if (pd) { | 1616 | if (pd) { |
1617 | dev = to_mdev(pd->device); | 1617 | dev = to_mdev(pd->device); |
1618 | } else { | ||
1619 | /* being cautious here */ | ||
1620 | if (init_attr->qp_type != IB_QPT_XRC_TGT && | ||
1621 | init_attr->qp_type != MLX5_IB_QPT_REG_UMR) { | ||
1622 | pr_warn("%s: no PD for transport %s\n", __func__, | ||
1623 | ib_qp_type_str(init_attr->qp_type)); | ||
1624 | return ERR_PTR(-EINVAL); | ||
1625 | } | ||
1626 | dev = to_mdev(to_mxrcd(init_attr->xrcd)->ibxrcd.device); | ||
1627 | 1618 | ||
1628 | if (init_attr->qp_type == IB_QPT_RAW_PACKET) { | 1619 | if (init_attr->qp_type == IB_QPT_RAW_PACKET) { |
1629 | if (!pd->uobject) { | 1620 | if (!pd->uobject) { |
@@ -1634,6 +1625,15 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, | |||
1634 | return ERR_PTR(-EINVAL); | 1625 | return ERR_PTR(-EINVAL); |
1635 | } | 1626 | } |
1636 | } | 1627 | } |
1628 | } else { | ||
1629 | /* being cautious here */ | ||
1630 | if (init_attr->qp_type != IB_QPT_XRC_TGT && | ||
1631 | init_attr->qp_type != MLX5_IB_QPT_REG_UMR) { | ||
1632 | pr_warn("%s: no PD for transport %s\n", __func__, | ||
1633 | ib_qp_type_str(init_attr->qp_type)); | ||
1634 | return ERR_PTR(-EINVAL); | ||
1635 | } | ||
1636 | dev = to_mdev(to_mxrcd(init_attr->xrcd)->ibxrcd.device); | ||
1637 | } | 1637 | } |
1638 | 1638 | ||
1639 | switch (init_attr->qp_type) { | 1639 | switch (init_attr->qp_type) { |