Commit 5d1af5c8 authored by Miroslaw Walukiewicz's avatar Miroslaw Walukiewicz Committed by Roland Dreier
Browse files

RDMA/nes: Fix resource issues in nes_create_cq() and nes_destroy_cq() 



In error paths where a CQ is not created, pbl is not freeed properly.

In nes_destroy_cq(), add the corresponding check for nescq->mcrqf to
not call nes_free_resource() when it is already done in nes_create_cq().

Signed-off-by: default avatarMiroslaw Walukiewicz <miroslaw.walukiewicz@intel.com>
Signed-off-by: default avatarChien Tung <chien.tin.tung@intel.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent cc005fa2

drivers/infiniband/hw/nes/nes_verbs.c

+25 −1
Original line number Diff line number Diff line
@@ -1627,6 +1627,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
				nescq->hw_cq.cq_number = nes_ucontext->mcrqf & 0xffff;

			else

				nescq->hw_cq.cq_number = nesvnic->mcrq_qp_id + nes_ucontext->mcrqf-1;

			nescq->mcrqf = nes_ucontext->mcrqf;

			nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

		}

		nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
@@ -1682,6 +1683,12 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
		if (!context)

			pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,

					nescq->hw_cq.cq_pbase);

		else {

			pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,

					    nespbl->pbl_vbase, nespbl->pbl_pbase);

			kfree(nespbl);

		}



		nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

		kfree(nescq);

		return ERR_PTR(-ENOMEM);
@@ -1705,6 +1712,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
				if (!context)

					pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,

							nescq->hw_cq.cq_pbase);

				else {

					pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,

							    nespbl->pbl_vbase, nespbl->pbl_pbase);

					kfree(nespbl);

				}

				nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

				kfree(nescq);

				return ERR_PTR(-ENOMEM);
@@ -1722,6 +1734,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
				if (!context)

					pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,

							nescq->hw_cq.cq_pbase);

				else {

					pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,

							    nespbl->pbl_vbase, nespbl->pbl_pbase);

					kfree(nespbl);

				}

				nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

				kfree(nescq);

				return ERR_PTR(-ENOMEM);
@@ -1774,6 +1791,11 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries, 
		if (!context)

			pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,

					nescq->hw_cq.cq_pbase);

		else {

			pci_free_consistent(nesdev->pcidev, nespbl->pbl_size,

					    nespbl->pbl_vbase, nespbl->pbl_pbase);

			kfree(nespbl);

		}

		nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);

		kfree(nescq);

		return ERR_PTR(-EIO);
@@ -1855,7 +1877,9 @@ static int nes_destroy_cq(struct ib_cq *ib_cq) 
	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_OPCODE_IDX, opcode);

	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_ID_IDX,

		(nescq->hw_cq.cq_number | ((u32)PCI_FUNC(nesdev->pcidev->devfn) << 16)));

	if (!nescq->mcrqf)

		nes_free_resource(nesadapter, nesadapter->allocated_cqs, nescq->hw_cq.cq_number);



	atomic_set(&cqp_request->refcount, 2);

	nes_post_cqp_request(nesdev, cqp_request);

drivers/infiniband/hw/nes/nes_verbs.h

+1 −0
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ struct nes_cq { 
	spinlock_t       lock;

	u8               virtual_cq;

	u8               pad[3];

	u32		 mcrqf;

};



struct nes_wq {

CRA Git | Maintained and supported by SUSTech CRA and CCSE