summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorHaggai Eran <haggaie@mellanox.com>2015-09-21 16:02:02 +0300
committerDoug Ledford <dledford@redhat.com>2015-10-20 13:13:42 -0400
commitb3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e (patch)
treec1934c46d632a5b5b27fae8525c054770ea552f5 /drivers
parent3909642034ffd7a8906ff3f2b2a71455bf39e7f6 (diff)
IB/cma: Potential NULL dereference in cma_id_from_event
If the lookup of a listening ID failed for an AF_IB request, the code would try to call dev_put() on a NULL net_dev. Fixes: be688195bd08 ("IB/cma: Fix net_dev reference leak with failed requests") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Haggai Eran <haggaie@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/infiniband/core/cma.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 59a2dafc8c57..f163ac680841 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1324,7 +1324,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
bind_list = cma_ps_find(rdma_ps_from_service_id(req.service_id),
cma_port_from_service_id(req.service_id));
id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
- if (IS_ERR(id_priv)) {
+ if (IS_ERR(id_priv) && *net_dev) {
dev_put(*net_dev);
*net_dev = NULL;
}