[ofw][patch][MLX4] application crash in case of IOCTL failure

[Leonid Keller]

[MLX4] fixed application crash in case of IOCTL failure. [mlnx:3498]

The crash is caused by double cleaning of vendor objects: once upon
handling IOCTL error in post function, second time - when IBAL calls
destroy function for cleanup.

 
Index: core/al/user/ual_cq.c
===================================================================
--- core/al/user/ual_cq.c (revision 1765)
+++ core/al/user/ual_cq.c (working copy)
@@ -162,19 +162,6 @@
   h_cq->h_rearm_n_cq = h_cq;
  }
 
- if( status != IB_SUCCESS )
- {
-  CL_ASSERT( !h_cq->h_ci_cq );
-  /*
-   * If we failed to create the CQ in the kernel, clear the h_ci_cq
-   * pointer to prevent trying to clean it up later.  This is needed
-   * to work-around the uVPD incorrectly setting the handle in the
-   * post_create_cq call even in the case of a failure.
-   */
-  /* TODO: Fix the UVP. */
-  h_cq->h_ci_cq = NULL;
- }
-
  AL_EXIT( AL_DBG_CQ );
  return status;
 }
Index: hw/mlx4/user/hca/verbs.c
===================================================================
--- hw/mlx4/user/hca/verbs.c (revision 1765)
+++ hw/mlx4/user/hca/verbs.c (working copy)
@@ -96,6 +96,7 @@
   if (!mlx4_fill_context(context, p_resp))
   {
    status = IB_INSUFFICIENT_RESOURCES;
+   *ph_uvp_ca = NULL;
    goto end;
   }
  }
@@ -115,6 +116,7 @@
  CL_ASSERT(context);
 
  if (IB_SUCCESS == ioctl_status)
+  
   mlx4_free_context(context);
 
  return IB_SUCCESS;
@@ -185,6 +187,7 @@
  else
  {
   cl_free(to_mpd(pd));
+  *ph_uvp_pd = NULL;
  }
  
  cl_free(p_resp);
@@ -329,6 +332,7 @@
  else
  {
   mlx4_post_destroy_cq (*ph_uvp_cq, IB_SUCCESS);
+  *ph_uvp_cq = NULL;
  }
  
  cl_free(p_resp);
@@ -489,6 +493,7 @@
  else
  {
   mlx4_post_destroy_srq (*ph_uvp_srq, IB_SUCCESS);
+  *ph_uvp_srq = NULL;
  }
 
  cl_free(p_resp);
@@ -813,6 +818,7 @@
  else
  {
   mlx4_post_destroy_qp(*ph_uvp_qp, IB_SUCCESS);
+  *ph_uvp_qp = NULL;
  }
 
  cl_free(p_resp);
@@ -1361,6 +1367,7 @@
  else
  {
   mlx4_post_destroy_srq (*ph_uvp_srq, IB_SUCCESS);
+  *ph_uvp_srq = NULL;
  }
 
  cl_free( p_resp );
@@ -1442,6 +1449,7 @@
  else
  {
   cl_free(to_mxrcd(xrcd));
+  *ph_uvp_xrcd = NULL;
  }
  
  cl_free(p_resp);
Index: hw/mthca/user/mlnx_ual_cq.c
===================================================================
--- hw/mthca/user/mlnx_ual_cq.c (revision 1765)
+++ hw/mthca/user/mlnx_ual_cq.c (working copy)
@@ -57,8 +57,6 @@
  struct ibv_create_cq *p_create_cq;
  int err;
 
- UNREFERENCED_PARAMETER(ph_uvp_cq);
-
  UVP_ENTER(UVP_DBG_CQ);
 
  CL_ASSERT(p_umv_buf);
@@ -83,6 +81,7 @@
   goto err_alloc_cq;
  }
 
+ *ph_uvp_cq = (ib_cq_handle_t)(ULONG_PTR)p_create_cq->user_handle;
  goto end;
   
 err_alloc_cq:
@@ -128,11 +127,13 @@
 
   *ph_uvp_cq = (ib_cq_handle_t)ibv_cq;
  }
- goto end;
+ else {
+  ibv_cq = (struct ibv_cq *)*ph_uvp_cq;
+  ibv_cq->context->ops.destroy_cq( ibv_cq );
+  *ph_uvp_cq = NULL;
+ }
 
- p_hobul->ibv_ctx->ops.destroy_cq(ibv_cq);
 err_create_cq:
-end: 
  if (p_resp)
   cl_free( p_resp );
  UVP_EXIT(UVP_DBG_CQ);

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openfabrics.org/pipermail/ofw/attachments/20081123/2395757c/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ioctl_failure.patch
Type: application/octet-stream
Size: 2858 bytes
Desc: ioctl_failure.patch
URL: <http://lists.openfabrics.org/pipermail/ofw/attachments/20081123/2395757c/attachment.obj>