From: Lijun Ou <ouli...@huawei.com>

Some pointers have not be checked when they are null,
so we add check for them.

Signed-off-by: Lijun Ou <ouli...@huawei.com>
Signed-off-by: Dongdong Huang(Donald) <hdd.hu...@huawei.com>
Reviewed-by:  Wei Hu (Xavier) <xavier.hu...@huawei.com>
Signed-off-by: Salil Mehta <salil.me...@huawei.com>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v1.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c 
b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index f0d6315..e3e154c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -92,6 +92,12 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct 
ib_send_wr *wr,
                }
 
                wqe = get_send_wqe(qp, ind & (qp->sq.wqe_cnt - 1));
+               if (unlikely(!wqe)) {
+                       dev_err(dev, "get send wqe failed\n");
+                       ret = -EINVAL;
+                       *bad_wr = wr;
+                       goto out;
+               }
                qp->sq.wrid[(qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1)] =
                                                                      wr->wr_id;
 
@@ -1558,6 +1564,11 @@ static int hns_roce_v1_poll_one(struct hns_roce_cq 
*hr_cq,
                sq_wqe = get_send_wqe(*cur_qp, roce_get_field(cqe->cqe_byte_4,
                                                CQE_BYTE_4_WQE_INDEX_M,
                                                CQE_BYTE_4_WQE_INDEX_S));
+               if (unlikely(!sq_wqe)) {
+                       dev_err(dev, "Get send wqe failed!\n");
+                       return -EFAULT;
+               }
+
                switch (sq_wqe->flag & HNS_ROCE_WQE_OPCODE_MASK) {
                case HNS_ROCE_WQE_OPCODE_SEND:
                        wc->opcode = IB_WC_SEND;
-- 
1.7.9.5

Reply via email to