diff options
| author | Majd Dibbiny <majd@mellanox.com> | 2016-01-28 17:51:48 +0200 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2016-02-02 16:42:22 -0500 |
| commit | 09f16cf59fbf825130c216c3af189253505dc9d9 (patch) | |
| tree | 83eaf9e7dd41596bc83285d9bbfb9ece5a64339b | |
| parent | a168a41c8147fe644f1144031a6ec27a1a13fe37 (diff) | |
| download | linux-09f16cf59fbf825130c216c3af189253505dc9d9.tar.gz linux-09f16cf59fbf825130c216c3af189253505dc9d9.tar.bz2 linux-09f16cf59fbf825130c216c3af189253505dc9d9.zip | |
IB/mlx5: Fix use of null pointer PD
When a Raw Ethernet QP is created, a NULL pointer PD could be used.
Fixing that by only using the PD after validating it's valid.
smatch also reported this error:
drivers/infiniband/hw/mlx5/qp.c:1629 mlx5_ib_create_qp()
error: we previously assumed 'pd' could be null (see line 1616)
Fixes: 0fb2ed66a14c ('IB/mlx5: Add create and destroy functionality for Raw Packet QP')
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
| -rw-r--r-- | drivers/infiniband/hw/mlx5/qp.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index 8fb9c27485e1..40bbe962a1ce 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -1615,15 +1615,6 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, if (pd) { dev = to_mdev(pd->device); - } else { - /* being cautious here */ - if (init_attr->qp_type != IB_QPT_XRC_TGT && - init_attr->qp_type != MLX5_IB_QPT_REG_UMR) { - pr_warn("%s: no PD for transport %s\n", __func__, - ib_qp_type_str(init_attr->qp_type)); - return ERR_PTR(-EINVAL); - } - dev = to_mdev(to_mxrcd(init_attr->xrcd)->ibxrcd.device); if (init_attr->qp_type == IB_QPT_RAW_PACKET) { if (!pd->uobject) { @@ -1634,6 +1625,15 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, return ERR_PTR(-EINVAL); } } + } else { + /* being cautious here */ + if (init_attr->qp_type != IB_QPT_XRC_TGT && + init_attr->qp_type != MLX5_IB_QPT_REG_UMR) { + pr_warn("%s: no PD for transport %s\n", __func__, + ib_qp_type_str(init_attr->qp_type)); + return ERR_PTR(-EINVAL); + } + dev = to_mdev(to_mxrcd(init_attr->xrcd)->ibxrcd.device); } switch (init_attr->qp_type) { |