diff options
| author | Leon Romanovsky <leonro@mellanox.com> | 2019-06-16 15:05:20 +0300 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2019-06-20 22:17:59 +0300 |
| commit | 836a0fbb3e76f704ad65ddfb57f00725245e509b (patch) | |
| tree | 30d961b48c7029a952e6eeb5077d76ce0e4a5221 /drivers/infiniband/hw/hns/hns_roce_cq.c | |
| parent | 89a6da3cb8f30ee0aeca924d84bef688f22f883e (diff) | |
| download | linux-836a0fbb3e76f704ad65ddfb57f00725245e509b.tar.xz | |
RDMA: Check umem pointer validity prior to release
Update ib_umem_release() to behave similarly to kfree() and allow
submitting NULL pointer as safe input to this function.
Fixes: a52c8e2469c3 ("RDMA: Clean destroy CQ in drivers do not return errors")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/hw/hns/hns_roce_cq.c')
| -rw-r--r-- | drivers/infiniband/hw/hns/hns_roce_cq.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c index 7e198c9ffbfe..6b4d8e50aabe 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cq.c +++ b/drivers/infiniband/hw/hns/hns_roce_cq.c @@ -423,9 +423,8 @@ err_dbmap: err_mtt: hns_roce_mtt_cleanup(hr_dev, &hr_cq->hr_buf.hr_mtt); - if (udata) - ib_umem_release(hr_cq->umem); - else + ib_umem_release(hr_cq->umem); + if (!udata) hns_roce_ib_free_cq_buf(hr_dev, &hr_cq->hr_buf, hr_cq->ib_cq.cqe); @@ -451,9 +450,8 @@ void hns_roce_ib_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) hns_roce_free_cq(hr_dev, hr_cq); hns_roce_mtt_cleanup(hr_dev, &hr_cq->hr_buf.hr_mtt); + ib_umem_release(hr_cq->umem); if (udata) { - ib_umem_release(hr_cq->umem); - if (hr_cq->db_en == 1) hns_roce_db_unmap_user(rdma_udata_to_drv_context( udata, |