Commit a43402af authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Doug Ledford

IB/mthca: Check validity of output parameter pointer

The mthca driver didn't check supplied pointer to functions
mthca_cmd_poll() and mthca_cmd_wait(). This caused to the following
smatch errors:

drivers/infiniband/hw/mthca/mthca_cmd.c:371 mthca_cmd_poll() error: we previously assumed 'out_param' could be null (see line 353)
drivers/infiniband/hw/mthca/mthca_cmd.c:454 mthca_cmd_wait() error: we previously assumed 'out_param' could be null (see line 432)

In reality all callers of these functions are setting out_is_imm
flag are providing pointer too. However it is better to check
again to remove smatch errors to achieve warning free subsystem.
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent a22ed86c
...@@ -367,12 +367,16 @@ static int mthca_cmd_poll(struct mthca_dev *dev, ...@@ -367,12 +367,16 @@ static int mthca_cmd_poll(struct mthca_dev *dev,
goto out; goto out;
} }
if (out_is_imm) if (out_is_imm && out_param) {
*out_param = *out_param =
(u64) be32_to_cpu((__force __be32) (u64) be32_to_cpu((__force __be32)
__raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET)) << 32 | __raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET)) << 32 |
(u64) be32_to_cpu((__force __be32) (u64) be32_to_cpu((__force __be32)
__raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET + 4)); __raw_readl(dev->hcr + HCR_OUT_PARAM_OFFSET + 4));
} else if (out_is_imm) {
err = -EINVAL;
goto out;
}
status = be32_to_cpu((__force __be32) __raw_readl(dev->hcr + HCR_STATUS_OFFSET)) >> 24; status = be32_to_cpu((__force __be32) __raw_readl(dev->hcr + HCR_STATUS_OFFSET)) >> 24;
if (status) { if (status) {
...@@ -450,8 +454,12 @@ static int mthca_cmd_wait(struct mthca_dev *dev, ...@@ -450,8 +454,12 @@ static int mthca_cmd_wait(struct mthca_dev *dev,
err = mthca_status_to_errno(context->status); err = mthca_status_to_errno(context->status);
} }
if (out_is_imm) if (out_is_imm && out_param) {
*out_param = context->out_param; *out_param = context->out_param;
} else if (out_is_imm) {
err = -EINVAL;
goto out;
}
out: out:
spin_lock(&dev->cmd.context_lock); spin_lock(&dev->cmd.context_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment