From patchwork Fri Aug 10 18:25:34 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kleber Sacilotto de Souza X-Patchwork-Id: 1306341 X-Patchwork-Delegate: roland@digitalvampire.org Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id A87F9DF266 for ; Fri, 10 Aug 2012 18:35:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759745Ab2HJSfF (ORCPT ); Fri, 10 Aug 2012 14:35:05 -0400 Received: from bb40dc42.virtua.com.br ([187.64.220.66]:35923 "EHLO oc3035817862.ibm.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1759230Ab2HJSfF (ORCPT ); Fri, 10 Aug 2012 14:35:05 -0400 X-Greylist: delayed 542 seconds by postgrey-1.27 at vger.kernel.org; Fri, 10 Aug 2012 14:35:04 EDT Received: by oc3035817862.ibm.com (Postfix, from userid 500) id F3BC461B77; Fri, 10 Aug 2012 15:25:59 -0300 (BRT) From: Kleber Sacilotto de Souza To: linux-rdma@vger.kernel.org Cc: Roland Dreier , Sean Hefty , Hal Rosenstock , Or Gerlitz , Jack Morgenstein , cascardo@linux.vnet.ibm.com, brking@linux.vnet.ibm.com, Kleber Sacilotto de Souza Subject: [PATCH] IB/mlx4: check iboe netdev pointer before dereferencing it Date: Fri, 10 Aug 2012 15:25:34 -0300 Message-Id: <1344623134-22600-1-git-send-email-klebers@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.1 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org Unlike other parts of the mlx4_ib code, the function build_mlx_header() doesn't check if the iboe netdev of the given port is valid before derefering it, which can cause a crash if the ethernet interface has already been taken down. This patch fixes the problem by checking for a valid netdev pointer before using it to get the port MAC address. Signed-off-by: Kleber Sacilotto de Souza --- drivers/infiniband/hw/mlx4/qp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index a6d8ea0..f585edd 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -1407,6 +1407,7 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr, struct mlx4_wqe_mlx_seg *mlx = wqe; struct mlx4_wqe_inline_seg *inl = wqe + sizeof *mlx; struct mlx4_ib_ah *ah = to_mah(wr->wr.ud.ah); + struct net_device *ndev; union ib_gid sgid; u16 pkey; int send_size; @@ -1483,7 +1484,10 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr, memcpy(sqp->ud_header.eth.dmac_h, ah->av.eth.mac, 6); /* FIXME: cache smac value? */ - smac = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1]->dev_addr; + ndev = to_mdev(sqp->qp.ibqp.device)->iboe.netdevs[sqp->qp.port - 1]; + if (!ndev) + return -ENODEV; + smac = ndev->dev_addr; memcpy(sqp->ud_header.eth.smac_h, smac, 6); if (!memcmp(sqp->ud_header.eth.smac_h, sqp->ud_header.eth.dmac_h, 6)) mlx->flags |= cpu_to_be32(MLX4_WQE_CTRL_FORCE_LOOPBACK);