summaryrefslogtreecommitdiff
path: root/drivers/infiniband/hw/mlx4/cq.c
diff options
context:
space:
mode:
authorLeon Romanovsky <leonro@mellanox.com>2019-06-16 15:05:20 +0300
committerDoug Ledford <dledford@redhat.com>2019-06-20 22:17:59 +0300
commit836a0fbb3e76f704ad65ddfb57f00725245e509b (patch)
tree30d961b48c7029a952e6eeb5077d76ce0e4a5221 /drivers/infiniband/hw/mlx4/cq.c
parent89a6da3cb8f30ee0aeca924d84bef688f22f883e (diff)
downloadlinux-836a0fbb3e76f704ad65ddfb57f00725245e509b.tar.xz
RDMA: Check umem pointer validity prior to release
Update ib_umem_release() to behave similarly to kfree() and allow submitting NULL pointer as safe input to this function. Fixes: a52c8e2469c3 ("RDMA: Clean destroy CQ in drivers do not return errors") Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/hw/mlx4/cq.c')
-rw-r--r--drivers/infiniband/hw/mlx4/cq.c14
1 files changed, 5 insertions, 9 deletions
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 72f238ddafb5..a7d238d312f0 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -277,9 +277,8 @@ err_dbmap:
err_mtt:
mlx4_mtt_cleanup(dev->dev, &cq->buf.mtt);
- if (udata)
- ib_umem_release(cq->umem);
- else
+ ib_umem_release(cq->umem);
+ if (!udata)
mlx4_ib_free_cq_buf(dev, &cq->buf, cq->ibcq.cqe);
err_db:
@@ -468,11 +467,8 @@ err_buf:
kfree(cq->resize_buf);
cq->resize_buf = NULL;
- if (cq->resize_umem) {
- ib_umem_release(cq->resize_umem);
- cq->resize_umem = NULL;
- }
-
+ ib_umem_release(cq->resize_umem);
+ cq->resize_umem = NULL;
out:
mutex_unlock(&cq->resize_mutex);
@@ -494,11 +490,11 @@ void mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata)
struct mlx4_ib_ucontext,
ibucontext),
&mcq->db);
- ib_umem_release(mcq->umem);
} else {
mlx4_ib_free_cq_buf(dev, &mcq->buf, cq->cqe);
mlx4_db_free(dev->dev, &mcq->db);
}
+ ib_umem_release(mcq->umem);
}
static void dump_cqe(void *cqe)