Browse Source

hw/rdma: Verify that ptr is not NULL before freeing

To cover the case where fini() was called even when init() fails make
sure objects are not NULL before calling to non-null-safe destructors.

Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20190116151538.14088-1-yuval.shaia@oracle.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Yuval Shaia 6 years ago
parent
commit
a1aa88b7dc
2 changed files with 10 additions and 3 deletions
  1. 4 2
      hw/rdma/rdma_backend.c
  2. 6 1
      hw/rdma/rdma_rm.c

+ 4 - 2
hw/rdma/rdma_backend.c

@@ -1066,8 +1066,10 @@ static void mad_fini(RdmaBackendDev *backend_dev)
     pr_dbg("Stopping MAD\n");
     pr_dbg("Stopping MAD\n");
     disable_rdmacm_mux_async(backend_dev);
     disable_rdmacm_mux_async(backend_dev);
     qemu_chr_fe_disconnect(backend_dev->rdmacm_mux.chr_be);
     qemu_chr_fe_disconnect(backend_dev->rdmacm_mux.chr_be);
-    qlist_destroy_obj(QOBJECT(backend_dev->recv_mads_list.list));
-    qemu_mutex_destroy(&backend_dev->recv_mads_list.lock);
+    if (backend_dev->recv_mads_list.list) {
+        qlist_destroy_obj(QOBJECT(backend_dev->recv_mads_list.list));
+        qemu_mutex_destroy(&backend_dev->recv_mads_list.lock);
+    }
 }
 }
 
 
 int rdma_backend_get_gid_index(RdmaBackendDev *backend_dev,
 int rdma_backend_get_gid_index(RdmaBackendDev *backend_dev,

+ 6 - 1
hw/rdma/rdma_rm.c

@@ -41,6 +41,9 @@ static inline void res_tbl_init(const char *name, RdmaRmResTbl *tbl,
 
 
 static inline void res_tbl_free(RdmaRmResTbl *tbl)
 static inline void res_tbl_free(RdmaRmResTbl *tbl)
 {
 {
+    if (!tbl->bitmap) {
+        return;
+    }
     qemu_mutex_destroy(&tbl->lock);
     qemu_mutex_destroy(&tbl->lock);
     g_free(tbl->tbl);
     g_free(tbl->tbl);
     g_free(tbl->bitmap);
     g_free(tbl->bitmap);
@@ -655,5 +658,7 @@ void rdma_rm_fini(RdmaDeviceResources *dev_res, RdmaBackendDev *backend_dev,
     res_tbl_free(&dev_res->cq_tbl);
     res_tbl_free(&dev_res->cq_tbl);
     res_tbl_free(&dev_res->pd_tbl);
     res_tbl_free(&dev_res->pd_tbl);
 
 
-    g_hash_table_destroy(dev_res->qp_hash);
+    if (dev_res->qp_hash) {
+        g_hash_table_destroy(dev_res->qp_hash);
+    }
 }
 }