From 91d8442c0c16dbf1a6dd43928a3cda406d485a4d Mon Sep 17 00:00:00 2001 From: oulijun Date: Fri, 5 Jul 2019 13:48:29 +0800 Subject: [PATCH] RDMA/hns: Bugfix for creating qp attached to srq driver inclusion category: bugfix bugzilla: NA CVE: NA When create a qp and attached to srq, rq will no longer be used and the members of rq will be set zero. As a result, the wrid of rq will not be allocated and used. Fixes: 172d424d2b86 ("RDMA/hns: Add QP operations support for hip08 SoC") Feature or Bugfix:Bugfix Signed-off-by: oulijun Reviewed-by: liyangyang20 Reviewed-by: liuyixian Reviewed-by: Yang Yingliang Signed-off-by: Yang Yingliang --- drivers/infiniband/hw/hns/hns_roce_qp.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c index 28f1534bb5cf..e723670d8661 100644 --- a/drivers/infiniband/hw/hns/hns_roce_qp.c +++ b/drivers/infiniband/hw/hns/hns_roce_qp.c @@ -967,11 +967,18 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, hr_qp->sq.wrid = kcalloc(hr_qp->sq.wqe_cnt, sizeof(u64), GFP_KERNEL); - hr_qp->rq.wrid = kcalloc(hr_qp->rq.wqe_cnt, sizeof(u64), - GFP_KERNEL); - if (!hr_qp->sq.wrid || !hr_qp->rq.wrid) { + if (ZERO_OR_NULL_PTR(hr_qp->sq.wrid)) { ret = -ENOMEM; - goto err_wrid; + goto err_get_bufs; + } + + if (hr_qp->rq.wqe_cnt) { + hr_qp->rq.wrid = kcalloc(hr_qp->rq.wqe_cnt, sizeof(u64), + GFP_KERNEL); + if (ZERO_OR_NULL_PTR(hr_qp->rq.wrid)) { + ret = -ENOMEM; + goto err_sq_wrid; + } } } @@ -1060,8 +1067,8 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, to_hr_ucontext(ib_pd->uobject->context), &hr_qp->rdb); } else { - kfree(hr_qp->sq.wrid); - kfree(hr_qp->rq.wrid); + if (hr_qp->rq.wqe_cnt) + kfree(hr_qp->rq.wrid); } err_sq_dbmap: @@ -1073,6 +1080,9 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, hns_roce_db_unmap_user( to_hr_ucontext(ib_pd->uobject->context), &hr_qp->sdb); +err_sq_wrid: + if (!ib_pd->uobject) + kfree(hr_qp->sq.wrid); err_get_bufs: hns_roce_free_buf_list(buf_list, hr_qp->region_cnt); -- GitLab