RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset (a25984f3) · Commits · 戴 / test

When running against rdma-core that doesn't support doorbell recovery, the rdma_user_mmap_entry won't be allocated for doorbell recovery related mappings. We have a flag indicating whether rdma-core supports doorbell recovery or not which was used during initialization, however some cases didn't check that the rdma_user_mmap_entry exists before attempting to acquire it's offset. Fixes: ("RDMA/qedr: Add doorbell overflow recovery support") Link: https://lore.kernel.org/r/20191118150645.26602-1-michal.kalderon@marvell.com Signed-off-by:

Ariel Elior <ariel.elior@marvell.com> Signed-off-by:

Michal Kalderon <michal.kalderon@marvell.com> Signed-off-by:

Jason Gunthorpe <jgg@mellanox.com>

drivers/infiniband/hw/qedr/verbs.c

+10 −5

Original line number	Diff line number	Diff line
		@@ -683,7 +683,9 @@ static int qedr_copy_cq_uresp(struct qedr_dev *dev,

		uresp.db_offset = db_offset;
		uresp.icid = cq->icid;
		uresp.db_rec_addr = rdma_user_mmap_get_offset(cq->q.db_mmap_entry);
		if (cq->q.db_mmap_entry)
		uresp.db_rec_addr =
		rdma_user_mmap_get_offset(cq->q.db_mmap_entry);

		rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
		if (rc)
		@@ -1012,7 +1014,7 @@ err1:
		if (udata) {
		qedr_free_pbl(dev, &cq->q.pbl_info, cq->q.pbl_tbl);
		ib_umem_release(cq->q.umem);
		if (ctx)
		if (cq->q.db_mmap_entry)
		rdma_user_mmap_entry_remove(cq->q.db_mmap_entry);
		} else {
		dev->ops->common->chain_free(dev->cdev, &cq->pbl);
		@@ -1245,7 +1247,9 @@ static void qedr_copy_rq_uresp(struct qedr_dev *dev,
		}

		uresp->rq_icid = qp->icid;
		uresp->rq_db_rec_addr = rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
		if (qp->urq.db_mmap_entry)
		uresp->rq_db_rec_addr =
		rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
		}

		static void qedr_copy_sq_uresp(struct qedr_dev *dev,
		@@ -1260,6 +1264,7 @@ static void qedr_copy_sq_uresp(struct qedr_dev *dev,
		else
		uresp->sq_icid = qp->icid + 1;

		if (qp->usq.db_mmap_entry)
		uresp->sq_db_rec_addr =
		rdma_user_mmap_get_offset(qp->usq.db_mmap_entry);
		}

Admin message