[ofa-general] [PATCH] ipoib/cm: fix error handling when out of memory

[Michael S. Tsirkin]

If skb allocation fails when we start the device, we call
ipoib_cm_dev_stop even though ipoib_cm_dev_open did not run to completion,
so we pass an invalid pointer to ib_destroy_cm_id and get an oops.

Fix by clearing cm.id on error, and testing it during cm_dev_stop.
This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=561>

Signed-off-by: Michael S. Tsirkin <mst at dev.mellanox.co.il>

---

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 2b242a4..10c105e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -594,7 +594,9 @@ int ipoib_cm_dev_open(struct net_device *dev)
 	priv->cm.id = ib_create_cm_id(priv->ca, ipoib_cm_rx_handler, dev);
 	if (IS_ERR(priv->cm.id)) {
 		printk(KERN_WARNING "%s: failed to create CM ID\n", priv->ca->name);
-		return IS_ERR(priv->cm.id);
+		ret = PTR_ERR(priv->cm.id);
+		priv->cm.id = NULL;
+		return ret;
 	}
 
 	ret = ib_cm_listen(priv->cm.id, cpu_to_be64(IPOIB_CM_IETF_ID | priv->qp->qp_num),
@@ -603,6 +605,7 @@ int ipoib_cm_dev_open(struct net_device *dev)
 		printk(KERN_WARNING "%s: failed to listen on ID 0x%llx\n", priv->ca->name,
 		       IPOIB_CM_IETF_ID | priv->qp->qp_num);
 		ib_destroy_cm_id(priv->cm.id);
+		priv->cm.id = NULL;
 		return ret;
 	}
 	return 0;
@@ -614,10 +617,11 @@ void ipoib_cm_dev_stop(struct net_device *dev)
 	struct ipoib_cm_rx *p;
 	unsigned long flags;
 
-	if (!IPOIB_CM_SUPPORTED(dev->dev_addr))
+	if (!IPOIB_CM_SUPPORTED(dev->dev_addr) || !priv->cm.id)
 		return;
 
 	ib_destroy_cm_id(priv->cm.id);
+	priv->cm.id = NULL;
 	spin_lock_irqsave(&priv->lock, flags);
 	while (!list_empty(&priv->cm.passive_ids)) {
 		p = list_entry(priv->cm.passive_ids.next, typeof(*p), list);

-- 
MST