Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 445d6807 authored by Hal Rosenstock's avatar Hal Rosenstock Committed by Roland Dreier
Browse files

IB/mad: Fix error path if response alloc fails in ib_mad_recv_done_handler() 



If ib_mad_recv_done_handler() fails to allocate response, then it just
printed a warning and continued, which leads to an oops if the MAD is
being handled for a switch device, because the switch code uses
response without checking for NULL.  Fix this by bailing out of the
function if the allocation fails.

Signed-off-by: default avatarSuresh Shelvapille <suri@baymicrosystems.com>
Signed-off-by: default avatarHal Rosenstock <hal.rosenstock@gmail.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 53998910

drivers/infiniband/core/mad.c

+8 −6
Original line number Diff line number Diff line
@@ -1842,16 +1842,11 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv, 
{

	struct ib_mad_qp_info *qp_info;

	struct ib_mad_private_header *mad_priv_hdr;

	struct ib_mad_private *recv, *response;

	struct ib_mad_private *recv, *response = NULL;

	struct ib_mad_list_head *mad_list;

	struct ib_mad_agent_private *mad_agent;

	int port_num;



	response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);

	if (!response)

		printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "

		       "for response buffer\n");



	mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;

	qp_info = mad_list->mad_queue->qp_info;

	dequeue_mad(mad_list);
@@ -1879,6 +1874,13 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv, 
	if (!validate_mad(&recv->mad.mad, qp_info->qp->qp_num))

		goto out;



	response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);

	if (!response) {

		printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "

		       "for response buffer\n");

		goto out;

	}



	if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)

		port_num = wc->port_num;

	else