RDMA/cxgb3: Clean up properly on FW mismatch failures

FW mismatches can cause a crash in the iw_cxgb3 event handler.

- NULL the t3cdev->ulp pointer on failures in cxio_rdev_open()
- Silently ignore events when the ulp ptr is NULL in iwch_err_handler()

Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

2 files changed, 5 insertions, 1 deletions

diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 4dec515c676c..72ed3396b721 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -1034,6 +1034,7 @@ err3:
 err2:
         cxio_hal_destroy_ctrl_qp(rdev_p);
 err1:
+        rdev_p->t3cdev_p->ulp = NULL;
         list_del(&rdev_p->entry);
         return err;
 }
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
index 5796170b0b25..3f0c99daae8c 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.c
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -165,10 +165,13 @@ static void close_rnic_dev(struct t3cdev *tdev)
 static void iwch_event_handler(struct t3cdev *tdev, u32 evt, u32 port_id)
 {
         struct cxio_rdev *rdev = tdev->ulp;
-        struct iwch_dev *rnicp = rdev_to_iwch_dev(rdev);
+        struct iwch_dev *rnicp;
         struct ib_event event;
         u32    portnum = port_id + 1;
 
+        if (!rdev)
+                return;
+        rnicp = rdev_to_iwch_dev(rdev);
         switch (evt) {
         case OFFLOAD_STATUS_DOWN: {
                 rdev->flags = CXIO_ERROR_FATAL;