RDMA/mlx5: Protect from NULL pointer derefence
authorLeon Romanovsky <leonro@mellanox.com>
Tue, 13 Mar 2018 13:29:24 +0000 (15:29 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 24 Apr 2018 07:36:31 +0000 (09:36 +0200)
commit 4289861d88d6c7b5e4c8cc7fe2ad6cdf0cdfc366 upstream.

The mlx5_ib_alloc_implicit_mr() can fail to acquire pages
and the returned mr pointer won't be valid. Ensure that it
is not error prior to access.

Cc: <stable@vger.kernel.org> # 4.10
Fixes: 81713d3788d2 ("IB/mlx5: Add implicit MR support")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/infiniband/hw/mlx5/mr.c

index 6d48d8a93b62ca48178937698f848ab5b4e0a0c0..538f1784863a1b43ba08d010c0e536324e686238 100644 (file)
@@ -1220,6 +1220,8 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                        return ERR_PTR(-EINVAL);
 
                mr = mlx5_ib_alloc_implicit_mr(to_mpd(pd), access_flags);
+               if (IS_ERR(mr))
+                       return ERR_CAST(mr);
                return &mr->ibmr;
        }
 #endif