aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/hw/mlx5/mr.c
diff options
context:
space:
mode:
authorLeon Romanovsky <leonro@mellanox.com>2019-06-16 08:05:20 -0400
committerDoug Ledford <dledford@redhat.com>2019-06-20 15:17:59 -0400
commit836a0fbb3e76f704ad65ddfb57f00725245e509b (patch)
tree30d961b48c7029a952e6eeb5077d76ce0e4a5221 /drivers/infiniband/hw/mlx5/mr.c
parent89a6da3cb8f30ee0aeca924d84bef688f22f883e (diff)
RDMA: Check umem pointer validity prior to release
Update ib_umem_release() to behave similarly to kfree() and allow submitting NULL pointer as safe input to this function. Fixes: a52c8e2469c3 ("RDMA: Clean destroy CQ in drivers do not return errors") Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/hw/mlx5/mr.c')
-rw-r--r--drivers/infiniband/hw/mlx5/mr.c13
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 4d033796dcfc..994abcebb057 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1507,10 +1507,9 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
1507 return 0; 1507 return 0;
1508 1508
1509err: 1509err:
1510 if (mr->umem) { 1510 ib_umem_release(mr->umem);
1511 ib_umem_release(mr->umem); 1511 mr->umem = NULL;
1512 mr->umem = NULL; 1512
1513 }
1514 clean_mr(dev, mr); 1513 clean_mr(dev, mr);
1515 return err; 1514 return err;
1516} 1515}
@@ -1630,10 +1629,10 @@ static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
1630 * remove the DMA mapping. 1629 * remove the DMA mapping.
1631 */ 1630 */
1632 mlx5_mr_cache_free(dev, mr); 1631 mlx5_mr_cache_free(dev, mr);
1633 if (umem) { 1632 ib_umem_release(umem);
1634 ib_umem_release(umem); 1633 if (umem)
1635 atomic_sub(npages, &dev->mdev->priv.reg_pages); 1634 atomic_sub(npages, &dev->mdev->priv.reg_pages);
1636 } 1635
1637 if (!mr->allocated_from_cache) 1636 if (!mr->allocated_from_cache)
1638 kfree(mr); 1637 kfree(mr);
1639} 1638}