diff options
| author | Tom Tucker <tom@opengridcomputing.com> | 2008-04-17 08:09:34 +0400 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2008-04-17 08:09:34 +0400 |
| commit | 9285faa1e7c8ffcc8901c40f6e1cc06d93e92431 (patch) | |
| tree | 094647e312edba67f6f5b555020ecb6fd7f34f67 /drivers/infiniband/hw/amso1100 | |
| parent | bbf8eed1a0f8949f7385146624f736f829992a70 (diff) | |
| download | linux-9285faa1e7c8ffcc8901c40f6e1cc06d93e92431.tar.xz | |
RDMA/amso1100: Add check for NULL reply_msg in c2_intr()
Fix a place where we might dereference a NULL pointer; this fixes
Coverity CID 1392. On inspection I also found a place where we could
attempt to kmem_cache_free() a NULL pointer, so fix this too.
Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw/amso1100')
| -rw-r--r-- | drivers/infiniband/hw/amso1100/c2_cq.c | 4 | ||||
| -rw-r--r-- | drivers/infiniband/hw/amso1100/c2_intr.c | 6 |
2 files changed, 7 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/amso1100/c2_cq.c b/drivers/infiniband/hw/amso1100/c2_cq.c index d2b3366786d6..bb17cce3cb59 100644 --- a/drivers/infiniband/hw/amso1100/c2_cq.c +++ b/drivers/infiniband/hw/amso1100/c2_cq.c @@ -422,8 +422,8 @@ void c2_free_cq(struct c2_dev *c2dev, struct c2_cq *cq) goto bail1; reply = (struct c2wr_cq_destroy_rep *) (unsigned long) (vq_req->reply_msg); - - vq_repbuf_free(c2dev, reply); + if (reply) + vq_repbuf_free(c2dev, reply); bail1: vq_req_free(c2dev, vq_req); bail0: diff --git a/drivers/infiniband/hw/amso1100/c2_intr.c b/drivers/infiniband/hw/amso1100/c2_intr.c index 0d0bc33ca30a..3b5095470cb3 100644 --- a/drivers/infiniband/hw/amso1100/c2_intr.c +++ b/drivers/infiniband/hw/amso1100/c2_intr.c @@ -174,7 +174,11 @@ static void handle_vq(struct c2_dev *c2dev, u32 mq_index) return; } - err = c2_errno(reply_msg); + if (reply_msg) + err = c2_errno(reply_msg); + else + err = -ENOMEM; + if (!err) switch (req->event) { case IW_CM_EVENT_ESTABLISHED: c2_set_qp_state(req->qp, |