Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752375AbdH1JKK (ORCPT ); Mon, 28 Aug 2017 05:10:10 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:33136 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752019AbdH1IIf (ORCPT ); Mon, 28 Aug 2017 04:08:35 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Potnuri Bharat Teja , Matan Barak , Doug Ledford Subject: [PATCH 4.12 66/99] RDMA/uverbs: Initialize cq_context appropriately Date: Mon, 28 Aug 2017 10:05:04 +0200 Message-Id: <20170828080458.898081983@linuxfoundation.org> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20170828080455.968552605@linuxfoundation.org> References: <20170828080455.968552605@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1321 Lines: 35 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bharat Potnuri commit 65159c051c45f269cf40a14f9404248f2d524920 upstream. Initializing cq_context with ev_queue in create_cq(), leads to NULL pointer dereference in ib_uverbs_comp_handler(), if application doesnot use completion channel. This patch fixes the cq_context initialization. Fixes: 1e7710f3f65 ("IB/core: Change completion channel to use the reworked") Signed-off-by: Potnuri Bharat Teja Reviewed-by: Matan Barak Signed-off-by: Doug Ledford (cherry picked from commit 699a2d5b1b880b4e4e1c7d55fa25659322cf5b51) Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/core/uverbs_cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -1015,7 +1015,7 @@ static struct ib_ucq_object *create_cq(s cq->uobject = &obj->uobject; cq->comp_handler = ib_uverbs_comp_handler; cq->event_handler = ib_uverbs_cq_event_handler; - cq->cq_context = &ev_file->ev_queue; + cq->cq_context = ev_file ? &ev_file->ev_queue : NULL; atomic_set(&cq->usecnt, 0); obj->uobject.object = cq;