[openib-general] [PATCH] [CM] fix freeing messages in CM error handling cases

[Sean Hefty]

This patch fixes cases in the CM where the wrong message is freed if
an error occurs trying to transition a cm_id to a new state.

For consistency, I had replicated this error throughout the CM,
and not just when sending DREQ, DREP.  It should be fixed in all
places now.

Signed-off-by: Sean Hefty <sean.hefty at intel.com>

Index: core/cm.c
===================================================================
--- core/cm.c	(revision 2055)
+++ core/cm.c	(working copy)
@@ -1160,7 +1160,7 @@ int ib_send_cm_rep(struct ib_cm_id *cm_i
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 
@@ -1205,7 +1205,7 @@ static void cm_resend_rtu(struct cm_id_p
 	ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
 			       &msg->send_wr, &bad_send_wr);
 	if (ret)
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 }
 
 int ib_send_cm_rtu(struct ib_cm_id *cm_id,
@@ -1239,7 +1239,7 @@ int ib_send_cm_rtu(struct ib_cm_id *cm_i
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 
@@ -1503,7 +1503,7 @@ int ib_send_cm_dreq(struct ib_cm_id *cm_
 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 out:
 	if (!msg_ret && ret)
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 	return ret;
 }
 EXPORT_SYMBOL(ib_send_cm_dreq);
@@ -1537,7 +1537,7 @@ static void cm_resend_drep(struct cm_id_
 	ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
 			       &msg->send_wr, &bad_send_wr);
 	if (ret)
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 }
 
 int ib_send_cm_drep(struct ib_cm_id *cm_id,
@@ -1572,7 +1572,7 @@ int ib_send_cm_drep(struct ib_cm_id *cm_
 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 out:
 	if (!msg_ret && ret)
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 	return ret;
 }
 EXPORT_SYMBOL(ib_send_cm_drep);
@@ -1755,7 +1755,7 @@ int ib_send_cm_rej(struct ib_cm_id *cm_i
 				 &msg->send_wr, &bad_send_wr);
 out:
 	if (!msg_ret && ret)
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 	return ret;
 }
 EXPORT_SYMBOL(ib_send_cm_rej);
@@ -1942,7 +1942,7 @@ int ib_send_cm_mra(struct ib_cm_id *cm_i
 
 	if (ret)  {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 
@@ -2038,7 +2038,7 @@ int ib_send_cm_lap(struct ib_cm_id *cm_i
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 
@@ -2174,7 +2174,7 @@ int ib_send_cm_apr(struct ib_cm_id *cm_i
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 	cm_id->lap_state = IB_CM_LAP_IDLE;
@@ -2322,7 +2322,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id 
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 	cm_id->state = IB_CM_SIDR_REQ_SENT;
@@ -2456,7 +2456,7 @@ int ib_send_cm_sidr_rep(struct ib_cm_id 
 
 	if (ret) {
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-		cm_free_msg(cm_id_priv->msg);
+		cm_free_msg(msg);
 		goto out;
 	}
 	cm_id->state = IB_CM_IDLE;