diff options
author | Haggai Eran <haggaie@mellanox.com> | 2015-09-21 16:02:02 +0300 |
---|---|---|
committer | Doug Ledford <dledford@redhat.com> | 2015-10-20 13:13:42 -0400 |
commit | b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e (patch) | |
tree | c1934c46d632a5b5b27fae8525c054770ea552f5 | |
parent | 3909642034ffd7a8906ff3f2b2a71455bf39e7f6 (diff) | |
download | op-kernel-dev-b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e.zip op-kernel-dev-b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e.tar.gz |
IB/cma: Potential NULL dereference in cma_id_from_event
If the lookup of a listening ID failed for an AF_IB request, the code
would try to call dev_put() on a NULL net_dev.
Fixes: be688195bd08 ("IB/cma: Fix net_dev reference leak with failed
requests")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
-rw-r--r-- | drivers/infiniband/core/cma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 59a2daf..f163ac6 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1324,7 +1324,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, bind_list = cma_ps_find(rdma_ps_from_service_id(req.service_id), cma_port_from_service_id(req.service_id)); id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev); - if (IS_ERR(id_priv)) { + if (IS_ERR(id_priv) && *net_dev) { dev_put(*net_dev); *net_dev = NULL; } |