Just noticed i didn't post [2/2] successfully, will sent it in next version.
On 21/10/2022 15:52, Li Zhijian wrote:
Before the testing, we already passed it to rxe_mr_copy() where mr could
be dereferenced. so this checking is not exactly correct.
I tried to figure out the details how/when mr could be NULL, but failed
at last. Add a WARN_ON(!mr) to that path to tell us more when it
happends.
Signed-off-by: Li Zhijian <lizhijian@xxxxxxxxxxx>
---
drivers/infiniband/sw/rxe/rxe_resp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ed5a09e86417..218c14fb07c6 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -778,6 +778,7 @@ static enum resp_states read_reply(struct rxe_qp *qp,
if (res->state == rdatm_res_state_new) {
if (!res->replay) {
mr = qp->resp.mr;
+ WARN_ON(!mr);
qp->resp.mr = NULL;
} else {
mr = rxe_recheck_mr(qp, res->read.rkey);
@@ -811,8 +812,7 @@ static enum resp_states read_reply(struct rxe_qp *qp,
rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt),
payload, RXE_FROM_MR_OBJ);
- if (mr)
- rxe_put(mr);
+ rxe_put(mr);
if (bth_pad(&ack_pkt)) {
u8 *pad = payload_addr(&ack_pkt) + payload;
