From: Juan Zhou <zhoujuan51@h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8NZ4Y -------------------------------------------------------------------------- Add parameter check in set_write_notify_param(). Fixes: 21cacb516f20 ("RDMA/hns: Support write with notify") Signed-off-by: Juan Zhou <zhoujuan51@h-partners.com> Signed-off-by: Chengchang Tang <tangchengchang@huawei.com> --- drivers/infiniband/hw/hns/hns_roce_cq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c index 2363e338765c..48c25b30a395 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cq.c +++ b/drivers/infiniband/hw/hns/hns_roce_cq.c @@ -392,6 +392,9 @@ static int set_write_notify_param(struct hns_roce_dev *hr_dev, notify_attr[attr].mem_type)) return -EOPNOTSUPP; + if (!hr_dev->notify_tbl || ucmd->notify_idx >= hr_dev->notify_num) + return -EINVAL; + hr_cq->flags |= HNS_ROCE_CQ_FLAG_NOTIFY_EN; hr_cq->write_notify.notify_addr = hr_dev->notify_tbl[ucmd->notify_idx].base_addr; -- 2.30.0