From 6aea938f54ca785ce3bea67a8948698225c6ca58 Mon Sep 17 00:00:00 2001 From: Julien Brunel Date: Fri, 10 Oct 2008 12:00:19 -0700 Subject: RDMA/ucma: Test ucma_alloc_multicast() return against NULL, not with IS_ERR() In case of error, the function ucma_alloc_multicast() returns a NULL pointer, but never returns an ERR pointer. So after a call to this function, an IS_ERR test should be replaced by a NULL test. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @match bad_is_err_test@ expression x, E; @@ x = ucma_alloc_multicast(...) ... when != x = E IS_ERR(x) // Signed-off-by: Julien Brunel Signed-off-by: Julia Lawall Signed-off-by: Roland Dreier --- drivers/infiniband/core/ucma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 3ddacf39b7ba..4346a24568fb 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -904,8 +904,8 @@ static ssize_t ucma_join_multicast(struct ucma_file *file, mutex_lock(&file->mut); mc = ucma_alloc_multicast(ctx); - if (IS_ERR(mc)) { - ret = PTR_ERR(mc); + if (!mc) { + ret = -ENOMEM; goto err1; } -- cgit v1.2.3 From 0540bbbe455e123a1692d26205ad1a29983883b0 Mon Sep 17 00:00:00 2001 From: Hoang-Nam Nguyen Date: Fri, 10 Oct 2008 14:40:39 -0700 Subject: IB/ehca: Don't allow creating UC QP with SRQ This patch prevents a UC QP to be created attached to an SRQ, since current firmware does not support this feature. Signed-off-by: Michael Faath Signed-off-by: Roland Dreier --- drivers/infiniband/hw/ehca/ehca_qp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c index 4dbe2870e014..40b578d601c5 100644 --- a/drivers/infiniband/hw/ehca/ehca_qp.c +++ b/drivers/infiniband/hw/ehca/ehca_qp.c @@ -502,6 +502,12 @@ static struct ehca_qp *internal_create_qp( if (init_attr->srq) { my_srq = container_of(init_attr->srq, struct ehca_qp, ib_srq); + if (qp_type == IB_QPT_UC) { + ehca_err(pd->device, "UC with SRQ not supported"); + atomic_dec(&shca->num_qps); + return ERR_PTR(-EINVAL); + } + has_srq = 1; parms.ext_type = EQPT_SRQBASE; parms.srq_qpn = my_srq->real_qp_num; -- cgit v1.2.3 From 2767840a5ca73fde62b25e0209aa9269ec4fa7c7 Mon Sep 17 00:00:00 2001 From: Roland Dreier Date: Fri, 10 Oct 2008 15:58:52 -0700 Subject: IPoIB: Always initialize poll_timer to avoid crash on unload ipoib_ib_dev_stop() does del_timer_sync(&priv->poll_timer), but if a P_key for an interface is not found, poll_timer is not initialized, so this leads to a crash or hang. Fix this by moving where poll_timer is initialized to ipoib_ib_dev_init(), which is always called. This fixes . Debugged-by: Yosef Etigin Signed-off-by: Roland Dreier --- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c index 0e748aeeae99..28eb6f03c588 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c @@ -685,10 +685,6 @@ int ipoib_ib_dev_open(struct net_device *dev) queue_delayed_work(ipoib_workqueue, &priv->ah_reap_task, round_jiffies_relative(HZ)); - init_timer(&priv->poll_timer); - priv->poll_timer.function = ipoib_ib_tx_timer_func; - priv->poll_timer.data = (unsigned long)dev; - set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); return 0; @@ -906,6 +902,9 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port) return -ENODEV; } + setup_timer(&priv->poll_timer, ipoib_ib_tx_timer_func, + (unsigned long) dev); + if (dev->flags & IFF_UP) { if (ipoib_ib_dev_open(dev)) { ipoib_transport_dev_cleanup(dev); -- cgit v1.2.3 From 528051746b24dd214883db11bcbb0e667f60447d Mon Sep 17 00:00:00 2001 From: Roland Dreier Date: Tue, 14 Oct 2008 14:05:36 -0700 Subject: IB/mad: Use krealloc() to resize snoop table Use krealloc() instead of kmalloc() followed by memcpy() when resizing the MAD module's snoop table. Also put parentheses around the new table size to avoid calculating the wrong size to allocate, which fixes a bug pointed out by Haven Hash . Signed-off-by: Roland Dreier --- drivers/infiniband/core/mad.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 49c45feccd5b..5c54fc2350be 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -406,19 +406,15 @@ static int register_snoop_agent(struct ib_mad_qp_info *qp_info, if (i == qp_info->snoop_table_size) { /* Grow table. */ - new_snoop_table = kmalloc(sizeof mad_snoop_priv * - qp_info->snoop_table_size + 1, - GFP_ATOMIC); + new_snoop_table = krealloc(qp_info->snoop_table, + sizeof mad_snoop_priv * + (qp_info->snoop_table_size + 1), + GFP_ATOMIC); if (!new_snoop_table) { i = -ENOMEM; goto out; } - if (qp_info->snoop_table) { - memcpy(new_snoop_table, qp_info->snoop_table, - sizeof mad_snoop_priv * - qp_info->snoop_table_size); - kfree(qp_info->snoop_table); - } + qp_info->snoop_table = new_snoop_table; qp_info->snoop_table_size++; } -- cgit v1.2.3 From dc35fac9e936c6cc6ad825fc7e4455468d10adc6 Mon Sep 17 00:00:00 2001 From: Steve Wise Date: Wed, 15 Oct 2008 10:50:34 -0700 Subject: RDMA/cxgb3: Remove cmid reference on tid allocation failures The error path in iwch_connect() can fail to drop the cmid reference, which will cause the process to hang when destroying the cmid. Signed-off-by: Steve Wise Signed-off-by: Roland Dreier --- drivers/infiniband/hw/cxgb3/iwch_cm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c index c325c44807e8..44e936e48a31 100644 --- a/drivers/infiniband/hw/cxgb3/iwch_cm.c +++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c @@ -1942,6 +1942,7 @@ fail4: fail3: cxgb3_free_atid(ep->com.tdev, ep->atid); fail2: + cm_id->rem_ref(cm_id); put_ep(&ep->com); out: return err; -- cgit v1.2.3