[PATCH] IB/mlx5: Fix potential NULL dereference in query_device

[Prathamesh Deshpande]

Smatch reported an inconsistent NULL check for 'uhw' in
mlx5_ib_query_device(). While 'uhw_outlen' is checked at the end of
the function before calling ib_copy_to_udata(), 'uhw' is explicitly
checked for NULL earlier in the same function.

If a caller provides a non-zero 'uhw_outlen' but a NULL 'uhw' pointer,
ib_copy_to_udata() will attempt to dereference 'uhw', leading to a
kernel panic. Fix this by checking the 'uhw' pointer directly.

Fixes: 4835709176e8 ("RDMA/mlx5: Don't fake udata for kernel path")

Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@xxxxxxxxx>
---
 drivers/infiniband/hw/mlx5/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 635002e684a5..471dc8df4a52 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1353,7 +1353,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
 			fill_esw_mgr_reg_c0(mdev, &resp);
 	}
 
-	if (uhw_outlen) {
+	if (uhw) {
 		err = ib_copy_to_udata(uhw, &resp, resp.response_length);
 
 		if (err)
-- 
2.43.0