Showing error 1733

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/infiniband/hw/mlx4/mad.c
Line in file: 215
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC

Source: 

185static void node_desc_override(struct ib_device *dev,
186                               struct ib_mad *mad)
187{
188        if ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED ||
189             mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) &&
190            mad->mad_hdr.method == IB_MGMT_METHOD_GET_RESP &&
191            mad->mad_hdr.attr_id == IB_SMP_ATTR_NODE_DESC) {
192                spin_lock(&to_mdev(dev)->sm_lock);
193                memcpy(((struct ib_smp *) mad)->data, dev->node_desc, 64);
194                spin_unlock(&to_mdev(dev)->sm_lock);
195        }
196}
197
198static void forward_trap(struct mlx4_ib_dev *dev, u8 port_num, struct ib_mad *mad)
199{
200        int qpn = mad->mad_hdr.mgmt_class != IB_MGMT_CLASS_SUBN_LID_ROUTED;
201        struct ib_mad_send_buf *send_buf;
202        struct ib_mad_agent *agent = dev->send_agent[port_num - 1][qpn];
203        int ret;
204
205        if (agent) {
206                send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
207                                              IB_MGMT_MAD_DATA, GFP_ATOMIC);
208                /*
209                 * We rely here on the fact that MLX QPs don't use the
210                 * address handle after the send is posted (this is
211                 * wrong following the IB spec strictly, but we know
212                 * it's OK for our devices).
213                 */
214                spin_lock(&dev->sm_lock);
215                memcpy(send_buf->mad, mad, sizeof *mad);
216                if ((send_buf->ah = dev->sm_ah[port_num - 1]))
217                        ret = ib_post_send_mad(send_buf, NULL);
218                else
219                        ret = -EINVAL;
220                spin_unlock(&dev->sm_lock);
221
222                if (ret)
223                        ib_free_send_mad(send_buf);
224        }
225}
Show full sources
↑