evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

IB/mad: Fix error path if response alloc fails in ib_mad_recv_done_handler()

Browse source 
If ib_mad_recv_done_handler() fails to allocate response, then it just
printed a warning and continued, which leads to an oops if the MAD is
being handled for a switch device, because the switch code uses
response without checking for NULL.  Fix this by bailing out of the
function if the allocation fails.

Signed-off-by: Suresh Shelvapille <suri@baymicrosystems.com>
Signed-off-by: Hal Rosenstock <hal.rosenstock@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Hal Rosenstock 2007-08-03 10:45:17 -07:00 • committed by Roland Dreier
parent 5399891052
commit 445d68070c
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/infiniband/core/mad.c
View file

@ -1842,16 +1842,11 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
{ {
struct ib_mad_qp_info *qp_info; struct ib_mad_qp_info *qp_info;
struct ib_mad_private_header *mad_priv_hdr; struct ib_mad_private_header *mad_priv_hdr;
struct ib_mad_private *recv, *response; struct ib_mad_private *recv, *response = NULL;
struct ib_mad_list_head *mad_list; struct ib_mad_list_head *mad_list;
struct ib_mad_agent_private *mad_agent; struct ib_mad_agent_private *mad_agent;
int port_num; int port_num;
response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
if (!response)
printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "
"for response buffer\n");
mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id; mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
qp_info = mad_list->mad_queue->qp_info; qp_info = mad_list->mad_queue->qp_info;
dequeue_mad(mad_list); dequeue_mad(mad_list);
@ -1879,6 +1874,13 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
if (!validate_mad(&recv->mad.mad, qp_info->qp->qp_num)) if (!validate_mad(&recv->mad.mad, qp_info->qp->qp_num))
goto out; goto out;
response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
if (!response) {
printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "
"for response buffer\n");
goto out;
}
if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
port_num = wc->port_num; port_num = wc->port_num;
else else