[ofw][patch][MLX4] application crash in case of IOCTL failure

[Leonid Keller]

Applied 1772.


________________________________

	From: ofw-bounces at lists.openfabrics.org
[mailto:ofw-bounces at lists.openfabrics.org] On Behalf Of Leonid Keller
	Sent: Sunday, November 23, 2008 8:25 PM
	To: ofw at lists.openfabrics.org
	Subject: [ofw][patch][MLX4] application crash in case of IOCTL
failure
	
	
	[MLX4] fixed application crash in case of IOCTL failure.
[mlnx:3498]

	The crash is caused by double cleaning of vendor objects: once
upon handling IOCTL error in post function, second time - when IBAL
calls destroy function for cleanup.

	 
	Index: core/al/user/ual_cq.c
	
===================================================================
	--- core/al/user/ual_cq.c (revision 1765)
	+++ core/al/user/ual_cq.c (working copy)
	@@ -162,19 +162,6 @@
	   h_cq->h_rearm_n_cq = h_cq;
	  }
	 
	- if( status != IB_SUCCESS )
	- {
	-  CL_ASSERT( !h_cq->h_ci_cq );
	-  /*
	-   * If we failed to create the CQ in the kernel, clear the
h_ci_cq
	-   * pointer to prevent trying to clean it up later.  This is
needed
	-   * to work-around the uVPD incorrectly setting the handle in
the
	-   * post_create_cq call even in the case of a failure.
	-   */
	-  /* TODO: Fix the UVP. */
	-  h_cq->h_ci_cq = NULL;
	- }
	-
	  AL_EXIT( AL_DBG_CQ );
	  return status;
	 }
	Index: hw/mlx4/user/hca/verbs.c
	
===================================================================
	--- hw/mlx4/user/hca/verbs.c (revision 1765)
	+++ hw/mlx4/user/hca/verbs.c (working copy)
	@@ -96,6 +96,7 @@
	   if (!mlx4_fill_context(context, p_resp))
	   {
	    status = IB_INSUFFICIENT_RESOURCES;
	+   *ph_uvp_ca = NULL;
	    goto end;
	   }
	  }
	@@ -115,6 +116,7 @@
	  CL_ASSERT(context);
	 
	  if (IB_SUCCESS == ioctl_status)
	+  
	   mlx4_free_context(context);
	 
	  return IB_SUCCESS;
	@@ -185,6 +187,7 @@
	  else
	  {
	   cl_free(to_mpd(pd));
	+  *ph_uvp_pd = NULL;
	  }
	  
	  cl_free(p_resp);
	@@ -329,6 +332,7 @@
	  else
	  {
	   mlx4_post_destroy_cq (*ph_uvp_cq, IB_SUCCESS);
	+  *ph_uvp_cq = NULL;
	  }
	  
	  cl_free(p_resp);
	@@ -489,6 +493,7 @@
	  else
	  {
	   mlx4_post_destroy_srq (*ph_uvp_srq, IB_SUCCESS);
	+  *ph_uvp_srq = NULL;
	  }
	 
	  cl_free(p_resp);
	@@ -813,6 +818,7 @@
	  else
	  {
	   mlx4_post_destroy_qp(*ph_uvp_qp, IB_SUCCESS);
	+  *ph_uvp_qp = NULL;
	  }
	 
	  cl_free(p_resp);
	@@ -1361,6 +1367,7 @@
	  else
	  {
	   mlx4_post_destroy_srq (*ph_uvp_srq, IB_SUCCESS);
	+  *ph_uvp_srq = NULL;
	  }
	 
	  cl_free( p_resp );
	@@ -1442,6 +1449,7 @@
	  else
	  {
	   cl_free(to_mxrcd(xrcd));
	+  *ph_uvp_xrcd = NULL;
	  }
	  
	  cl_free(p_resp);
	Index: hw/mthca/user/mlnx_ual_cq.c
	
===================================================================
	--- hw/mthca/user/mlnx_ual_cq.c (revision 1765)
	+++ hw/mthca/user/mlnx_ual_cq.c (working copy)
	@@ -57,8 +57,6 @@
	  struct ibv_create_cq *p_create_cq;
	  int err;
	 
	- UNREFERENCED_PARAMETER(ph_uvp_cq);
	-
	  UVP_ENTER(UVP_DBG_CQ);
	 
	  CL_ASSERT(p_umv_buf);
	@@ -83,6 +81,7 @@
	   goto err_alloc_cq;
	  }
	 
	+ *ph_uvp_cq =
(ib_cq_handle_t)(ULONG_PTR)p_create_cq->user_handle;
	  goto end;
	   
	 err_alloc_cq:
	@@ -128,11 +127,13 @@
	 
	   *ph_uvp_cq = (ib_cq_handle_t)ibv_cq;
	  }
	- goto end;
	+ else {
	+  ibv_cq = (struct ibv_cq *)*ph_uvp_cq;
	+  ibv_cq->context->ops.destroy_cq( ibv_cq );
	+  *ph_uvp_cq = NULL;
	+ }
	 
	- p_hobul->ibv_ctx->ops.destroy_cq(ibv_cq);
	 err_create_cq:
	-end: 
	  if (p_resp)
	   cl_free( p_resp );
	  UVP_EXIT(UVP_DBG_CQ);
	

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openfabrics.org/pipermail/ofw/attachments/20081127/9459e709/attachment.html>