mad: In handle_outgoing_smp, validate process_mad routine exists prior to calling it (issue pointed out by KK)
Index: mad.c =================================================================== --- mad.c (revision 1189) +++ mad.c (working copy) @@ -405,30 +405,32 @@ goto error1; } - mad_agent_priv = container_of(mad_agent, - struct ib_mad_agent_private, - agent); - ret = mad_agent->device->process_mad( - mad_agent->device, - 0, - mad_agent->port_num, - smp->dr_slid, /* ? */ - (struct ib_mad *)smp, - (struct ib_mad *)&mad_priv->mad); - if ((ret & IB_MAD_RESULT_SUCCESS) && - (ret & IB_MAD_RESULT_REPLY)) { - if (!smi_handle_dr_smp_recv( - (struct ib_smp *)&mad_priv->mad, - mad_agent->device->node_type, - mad_agent->port_num, - mad_agent->device->phys_port_cnt)) { - ret = -EINVAL; - kmem_cache_free(ib_mad_cache, mad_priv); - goto error1; + if (mad_agent->device->process_mad) { + ret = mad_agent->device->process_mad( + mad_agent->device, + 0, + mad_agent->port_num, + smp->dr_slid, /* ? */ + (struct ib_mad *)smp, + (struct ib_mad *)&mad_priv->mad); + if ((ret & IB_MAD_RESULT_SUCCESS) && + (ret & IB_MAD_RESULT_REPLY)) { + if (!smi_handle_dr_smp_recv( + (struct ib_smp *)&mad_priv->mad, + mad_agent->device->node_type, + mad_agent->port_num, + mad_agent->device->phys_port_cnt)) { + ret = -EINVAL; + kmem_cache_free(ib_mad_cache, mad_priv); + goto error1; + } } } /* See if response is solicited and there is a recv handler */ + mad_agent_priv = container_of(mad_agent, + struct ib_mad_agent_private, + agent); if (solicited_mad(&mad_priv->mad.mad) && mad_agent_priv->agent.recv_handler) { struct ib_wc wc; _______________________________________________ openib-general mailing list [EMAIL PROTECTED] http://openib.org/mailman/listinfo/openib-general To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general