Showing error 1734

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/infiniband/hw/mthca/mthca_mad.c
Line in file: 176
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC

Source: 

146        if ((mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_LID_ROUTED ||
147             mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) &&
148            mad->mad_hdr.method == IB_MGMT_METHOD_GET_RESP &&
149            mad->mad_hdr.attr_id == IB_SMP_ATTR_NODE_DESC) {
150                mutex_lock(&to_mdev(dev)->cap_mask_mutex);
151                memcpy(((struct ib_smp *) mad)->data, dev->node_desc, 64);
152                mutex_unlock(&to_mdev(dev)->cap_mask_mutex);
153        }
154}
155
156static void forward_trap(struct mthca_dev *dev,
157                         u8 port_num,
158                         struct ib_mad *mad)
159{
160        int qpn = mad->mad_hdr.mgmt_class != IB_MGMT_CLASS_SUBN_LID_ROUTED;
161        struct ib_mad_send_buf *send_buf;
162        struct ib_mad_agent *agent = dev->send_agent[port_num - 1][qpn];
163        int ret;
164        unsigned long flags;
165
166        if (agent) {
167                send_buf = ib_create_send_mad(agent, qpn, 0, 0, IB_MGMT_MAD_HDR,
168                                              IB_MGMT_MAD_DATA, GFP_ATOMIC);
169                /*
170                 * We rely here on the fact that MLX QPs don't use the
171                 * address handle after the send is posted (this is
172                 * wrong following the IB spec strictly, but we know
173                 * it's OK for our devices).
174                 */
175                spin_lock_irqsave(&dev->sm_lock, flags);
176                memcpy(send_buf->mad, mad, sizeof *mad);
177                if ((send_buf->ah = dev->sm_ah[port_num - 1]))
178                        ret = ib_post_send_mad(send_buf, NULL);
179                else
180                        ret = -EINVAL;
181                spin_unlock_irqrestore(&dev->sm_lock, flags);
182
183                if (ret)
184                        ib_free_send_mad(send_buf);
185        }
186}
Show full sources
↑