From a25984f3baaa97079ce3e75c5a1d362155915a31 Mon Sep 17 00:00:00 2001 From: Michal Kalderon Date: Mon, 18 Nov 2019 17:06:45 +0200 Subject: RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset When running against rdma-core that doesn't support doorbell recovery, the rdma_user_mmap_entry won't be allocated for doorbell recovery related mappings. We have a flag indicating whether rdma-core supports doorbell recovery or not which was used during initialization, however some cases didn't check that the rdma_user_mmap_entry exists before attempting to acquire it's offset. Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support") Link: https://lore.kernel.org/r/20191118150645.26602-1-michal.kalderon@marvell.com Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: Jason Gunthorpe --- drivers/infiniband/hw/qedr/verbs.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'drivers/infiniband') diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index 55b77d753d12..4cd292966aa9 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -683,7 +683,9 @@ static int qedr_copy_cq_uresp(struct qedr_dev *dev, uresp.db_offset = db_offset; uresp.icid = cq->icid; - uresp.db_rec_addr = rdma_user_mmap_get_offset(cq->q.db_mmap_entry); + if (cq->q.db_mmap_entry) + uresp.db_rec_addr = + rdma_user_mmap_get_offset(cq->q.db_mmap_entry); rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp)); if (rc) @@ -1012,7 +1014,7 @@ err1: if (udata) { qedr_free_pbl(dev, &cq->q.pbl_info, cq->q.pbl_tbl); ib_umem_release(cq->q.umem); - if (ctx) + if (cq->q.db_mmap_entry) rdma_user_mmap_entry_remove(cq->q.db_mmap_entry); } else { dev->ops->common->chain_free(dev->cdev, &cq->pbl); @@ -1245,7 +1247,9 @@ static void qedr_copy_rq_uresp(struct qedr_dev *dev, } uresp->rq_icid = qp->icid; - uresp->rq_db_rec_addr = rdma_user_mmap_get_offset(qp->urq.db_mmap_entry); + if (qp->urq.db_mmap_entry) + uresp->rq_db_rec_addr = + rdma_user_mmap_get_offset(qp->urq.db_mmap_entry); } static void qedr_copy_sq_uresp(struct qedr_dev *dev, @@ -1260,8 +1264,9 @@ static void qedr_copy_sq_uresp(struct qedr_dev *dev, else uresp->sq_icid = qp->icid + 1; - uresp->sq_db_rec_addr = - rdma_user_mmap_get_offset(qp->usq.db_mmap_entry); + if (qp->usq.db_mmap_entry) + uresp->sq_db_rec_addr = + rdma_user_mmap_get_offset(qp->usq.db_mmap_entry); } static int qedr_copy_qp_uresp(struct qedr_dev *dev, -- cgit v1.2.3