RDMA/mlx5: Protect from NULL pointer derefence

Leon Romanovsky · dledford · commit 4289861d88d6 · 2018-03-15T10:59:58.000-04:00
The mlx5_ib_alloc_implicit_mr() can fail to acquire pages and the returned mr pointer won't be valid. Ensure that it is not error prior to access. Cc: <stable@vger.kernel.org> # 4.10 Fixes: 81713d3 ("IB/mlx5: Add implicit MR support") Reported-by: Noa Osherovich <noaos@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
@@ -1232,6 +1232,8 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 			return ERR_PTR(-EINVAL);
 
 		mr = mlx5_ib_alloc_implicit_mr(to_mpd(pd), access_flags);
+		if (IS_ERR(mr))
+			return ERR_CAST(mr);
 		return &mr->ibmr;
 	}
 #endif

Original file line number	Diff line number	Diff line change
`@@ -1232,6 +1232,8 @@ struct ib_mr mlx5_ib_reg_user_mr(struct ib_pd pd, u64 start, u64 length,`
`1232`	`1232`	`return ERR_PTR(-EINVAL);`
`1233`	`1233`
`1234`	`1234`	`mr = mlx5_ib_alloc_implicit_mr(to_mpd(pd), access_flags);`
	`1235`	`+ if (IS_ERR(mr))`
	`1236`	`+ return ERR_CAST(mr);`
`1235`	`1237`	`return &mr->ibmr;`
`1236`	`1238`	`}`
`1237`	`1239`	`#endif`