From: Sriharsha Basavapatna Date: Tue, 31 Oct 2017 09:29:17 +0000 (+0530) Subject: bnxt_re: fix a crash in qp error event processing X-Git-Tag: v4.15-rc1~73^2~39 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=d6d5c59905c8af932c1cee874e1fb5cd9e83fa61;p=uclinux-h8%2Flinux.git bnxt_re: fix a crash in qp error event processing In bnxt_qplib_process_qp_event(), for qp error events we look up the qp-handle and pass it for further processing. But we don't check if the handle is NULL. This could lead to a crash in the called functions when that qp-handle is dereferenced, if the qp is destroyed in the meantime. Fix this by checking for a valid qp-handle in that function. Signed-off-by: Sriharsha Basavapatna Signed-off-by: Doug Ledford --- diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c index 6d116146fa3c..a7b5de3e193c 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c @@ -302,6 +302,8 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, "QPLIB: qpid 0x%x, req_err=0x%x, resp_err=0x%x\n", qp_id, err_event->req_err_state_reason, err_event->res_err_state_reason); + if (!qp) + break; bnxt_qplib_acquire_cq_locks(qp, &flags); bnxt_qplib_mark_qp_error(qp); bnxt_qplib_release_cq_locks(qp, &flags);