From: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Date: Tue, 31 Oct 2017 14:59:17 +0530
Subject: bnxt_re: fix a crash in qp error event processing
Patch-mainline: v4.15-rc1
Git-commit: d6d5c59905c8af932c1cee874e1fb5cd9e83fa61
References: bsc#1050244 FATE#322915

In bnxt_qplib_process_qp_event(), for qp error events we look up the
qp-handle and pass it for further processing. But we don't check if the
handle is NULL. This could lead to a crash in the called functions when
that qp-handle is dereferenced, if the qp is destroyed in the meantime.
Fix this by checking for a valid qp-handle in that function.

Signed-off-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -306,6 +306,8 @@ static int bnxt_qplib_process_qp_event(s
 			"QPLIB: qpid 0x%x, req_err=0x%x, resp_err=0x%x\n",
 			qp_id, err_event->req_err_state_reason,
 			err_event->res_err_state_reason);
+		if (!qp)
+			break;
 		bnxt_qplib_acquire_cq_locks(qp, &flags);
 		bnxt_qplib_mark_qp_error(qp);
 		bnxt_qplib_release_cq_locks(qp, &flags);