Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=347fcfbed261fdd11f46fa03d524e1bddddab3a6
Commit:     347fcfbed261fdd11f46fa03d524e1bddddab3a6
Parent:     6b66b2da1e821181a001c00b04a807724ad803cd
Author:     Michael S. Tsirkin <[EMAIL PROTECTED]>
AuthorDate: Mon Apr 30 17:30:28 2007 -0700
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Mon Apr 30 17:30:28 2007 -0700

    IPoIB/cm: Fix error handling in ipoib_cm_dev_open()
    
    If skb allocation fails when we start the device, we call
    ipoib_cm_dev_stop() even though ipoib_cm_dev_open() did not run to
    completion, so we pass an invalid pointer to ib_destroy_cm_id and get
    an oops.
    
    Fix by clearing cm.id on error, and testing it in cm_dev_stop().
    This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=561>
    
    Signed-off-by: Michael S. Tsirkin <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
---
 drivers/infiniband/ulp/ipoib/ipoib_cm.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0c4e59b..7671741 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -592,7 +592,9 @@ int ipoib_cm_dev_open(struct net_device *dev)
        priv->cm.id = ib_create_cm_id(priv->ca, ipoib_cm_rx_handler, dev);
        if (IS_ERR(priv->cm.id)) {
                printk(KERN_WARNING "%s: failed to create CM ID\n", 
priv->ca->name);
-               return IS_ERR(priv->cm.id);
+               ret = PTR_ERR(priv->cm.id);
+               priv->cm.id = NULL;
+               return ret;
        }
 
        ret = ib_cm_listen(priv->cm.id, cpu_to_be64(IPOIB_CM_IETF_ID | 
priv->qp->qp_num),
@@ -601,6 +603,7 @@ int ipoib_cm_dev_open(struct net_device *dev)
                printk(KERN_WARNING "%s: failed to listen on ID 0x%llx\n", 
priv->ca->name,
                       IPOIB_CM_IETF_ID | priv->qp->qp_num);
                ib_destroy_cm_id(priv->cm.id);
+               priv->cm.id = NULL;
                return ret;
        }
        return 0;
@@ -611,10 +614,11 @@ void ipoib_cm_dev_stop(struct net_device *dev)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_cm_rx *p;
 
-       if (!IPOIB_CM_SUPPORTED(dev->dev_addr))
+       if (!IPOIB_CM_SUPPORTED(dev->dev_addr) || !priv->cm.id)
                return;
 
        ib_destroy_cm_id(priv->cm.id);
+       priv->cm.id = NULL;
        spin_lock_irq(&priv->lock);
        while (!list_empty(&priv->cm.passive_ids)) {
                p = list_entry(priv->cm.passive_ids.next, typeof(*p), list);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to