From: Michal Kalderon <michal.kalderon@marvell.com>
Date: Mon, 18 Nov 2019 17:06:45 +0200
Subject: RDMA/qedr: Fix null-pointer dereference when calling
 rdma_user_mmap_get_offset
Patch-mainline: v5.5-rc1
Git-commit: a25984f3baaa97079ce3e75c5a1d362155915a31
References: jsc#SLE-8215

When running against rdma-core that doesn't support doorbell recovery, the
rdma_user_mmap_entry won't be allocated for doorbell recovery related
mappings.

We have a flag indicating whether rdma-core supports doorbell recovery or
not which was used during initialization, however some cases didn't check
that the rdma_user_mmap_entry exists before attempting to acquire it's
offset.

Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support")
Link: https://lore.kernel.org/r/20191118150645.26602-1-michal.kalderon@marvell.com
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/hw/qedr/verbs.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -683,7 +683,9 @@ static int qedr_copy_cq_uresp(struct qed
 
 	uresp.db_offset = db_offset;
 	uresp.icid = cq->icid;
-	uresp.db_rec_addr = rdma_user_mmap_get_offset(cq->q.db_mmap_entry);
+	if (cq->q.db_mmap_entry)
+		uresp.db_rec_addr =
+			rdma_user_mmap_get_offset(cq->q.db_mmap_entry);
 
 	rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
 	if (rc)
@@ -1013,7 +1015,7 @@ err1:
 	if (udata) {
 		qedr_free_pbl(dev, &cq->q.pbl_info, cq->q.pbl_tbl);
 		ib_umem_release(cq->q.umem);
-		if (ctx)
+		if (cq->q.db_mmap_entry)
 			rdma_user_mmap_entry_remove(cq->q.db_mmap_entry);
 	} else {
 		dev->ops->common->chain_free(dev->cdev, &cq->pbl);
@@ -1246,7 +1248,9 @@ static void qedr_copy_rq_uresp(struct qe
 	}
 
 	uresp->rq_icid = qp->icid;
-	uresp->rq_db_rec_addr = rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
+	if (qp->urq.db_mmap_entry)
+		uresp->rq_db_rec_addr =
+			rdma_user_mmap_get_offset(qp->urq.db_mmap_entry);
 }
 
 static void qedr_copy_sq_uresp(struct qedr_dev *dev,
@@ -1261,8 +1265,9 @@ static void qedr_copy_sq_uresp(struct qe
 	else
 		uresp->sq_icid = qp->icid + 1;
 
-	uresp->sq_db_rec_addr =
-		rdma_user_mmap_get_offset(qp->usq.db_mmap_entry);
+	if (qp->usq.db_mmap_entry)
+		uresp->sq_db_rec_addr =
+			rdma_user_mmap_get_offset(qp->usq.db_mmap_entry);
 }
 
 static int qedr_copy_qp_uresp(struct qedr_dev *dev,