diff options
author | Leon Romanovsky <leonro@mellanox.com> | 2019-06-16 08:05:20 -0400 |
---|---|---|
committer | Doug Ledford <dledford@redhat.com> | 2019-06-20 15:17:59 -0400 |
commit | 836a0fbb3e76f704ad65ddfb57f00725245e509b (patch) | |
tree | 30d961b48c7029a952e6eeb5077d76ce0e4a5221 /drivers/infiniband/hw/mlx5/mr.c | |
parent | 89a6da3cb8f30ee0aeca924d84bef688f22f883e (diff) |
RDMA: Check umem pointer validity prior to release
Update ib_umem_release() to behave similarly to kfree() and allow
submitting NULL pointer as safe input to this function.
Fixes: a52c8e2469c3 ("RDMA: Clean destroy CQ in drivers do not return errors")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/hw/mlx5/mr.c')
-rw-r--r-- | drivers/infiniband/hw/mlx5/mr.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 4d033796dcfc..994abcebb057 100644 --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c | |||
@@ -1507,10 +1507,9 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, | |||
1507 | return 0; | 1507 | return 0; |
1508 | 1508 | ||
1509 | err: | 1509 | err: |
1510 | if (mr->umem) { | 1510 | ib_umem_release(mr->umem); |
1511 | ib_umem_release(mr->umem); | 1511 | mr->umem = NULL; |
1512 | mr->umem = NULL; | 1512 | |
1513 | } | ||
1514 | clean_mr(dev, mr); | 1513 | clean_mr(dev, mr); |
1515 | return err; | 1514 | return err; |
1516 | } | 1515 | } |
@@ -1630,10 +1629,10 @@ static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr) | |||
1630 | * remove the DMA mapping. | 1629 | * remove the DMA mapping. |
1631 | */ | 1630 | */ |
1632 | mlx5_mr_cache_free(dev, mr); | 1631 | mlx5_mr_cache_free(dev, mr); |
1633 | if (umem) { | 1632 | ib_umem_release(umem); |
1634 | ib_umem_release(umem); | 1633 | if (umem) |
1635 | atomic_sub(npages, &dev->mdev->priv.reg_pages); | 1634 | atomic_sub(npages, &dev->mdev->priv.reg_pages); |
1636 | } | 1635 | |
1637 | if (!mr->allocated_from_cache) | 1636 | if (!mr->allocated_from_cache) |
1638 | kfree(mr); | 1637 | kfree(mr); |
1639 | } | 1638 | } |