Commit 511585a2 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/qib: Correct sense on freectxts increment and decrement
  RDMA/cma: Verify private data length
  IB/mlx4: Fix shutdown crash accessing a non-existent bitmap
parents 64edb05e 480390c8
...@@ -2513,6 +2513,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv, ...@@ -2513,6 +2513,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
req.private_data_len = sizeof(struct cma_hdr) + req.private_data_len = sizeof(struct cma_hdr) +
conn_param->private_data_len; conn_param->private_data_len;
if (req.private_data_len < conn_param->private_data_len)
return -EINVAL;
req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC); req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
if (!req.private_data) if (!req.private_data)
return -ENOMEM; return -ENOMEM;
...@@ -2562,6 +2565,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, ...@@ -2562,6 +2565,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
memset(&req, 0, sizeof req); memset(&req, 0, sizeof req);
offset = cma_user_data_offset(id_priv->id.ps); offset = cma_user_data_offset(id_priv->id.ps);
req.private_data_len = offset + conn_param->private_data_len; req.private_data_len = offset + conn_param->private_data_len;
if (req.private_data_len < conn_param->private_data_len)
return -EINVAL;
private_data = kzalloc(req.private_data_len, GFP_ATOMIC); private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
if (!private_data) if (!private_data)
return -ENOMEM; return -ENOMEM;
......
...@@ -1244,6 +1244,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev) ...@@ -1244,6 +1244,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
err_counter: err_counter:
for (; i; --i) for (; i; --i)
if (ibdev->counters[i - 1] != -1)
mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]); mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]);
err_map: err_map:
...@@ -1275,6 +1276,7 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) ...@@ -1275,6 +1276,7 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
} }
iounmap(ibdev->uar_map); iounmap(ibdev->uar_map);
for (p = 0; p < ibdev->num_ports; ++p) for (p = 0; p < ibdev->num_ports; ++p)
if (ibdev->counters[p] != -1)
mlx4_counter_free(ibdev->dev, ibdev->counters[p]); mlx4_counter_free(ibdev->dev, ibdev->counters[p]);
mlx4_foreach_port(p, dev, MLX4_PORT_TYPE_IB) mlx4_foreach_port(p, dev, MLX4_PORT_TYPE_IB)
mlx4_CLOSE_PORT(dev, p); mlx4_CLOSE_PORT(dev, p);
......
...@@ -1285,7 +1285,7 @@ static int setup_ctxt(struct qib_pportdata *ppd, int ctxt, ...@@ -1285,7 +1285,7 @@ static int setup_ctxt(struct qib_pportdata *ppd, int ctxt,
strlcpy(rcd->comm, current->comm, sizeof(rcd->comm)); strlcpy(rcd->comm, current->comm, sizeof(rcd->comm));
ctxt_fp(fp) = rcd; ctxt_fp(fp) = rcd;
qib_stats.sps_ctxts++; qib_stats.sps_ctxts++;
dd->freectxts++; dd->freectxts--;
ret = 0; ret = 0;
goto bail; goto bail;
...@@ -1794,7 +1794,7 @@ static int qib_close(struct inode *in, struct file *fp) ...@@ -1794,7 +1794,7 @@ static int qib_close(struct inode *in, struct file *fp)
if (dd->pageshadow) if (dd->pageshadow)
unlock_expected_tids(rcd); unlock_expected_tids(rcd);
qib_stats.sps_ctxts--; qib_stats.sps_ctxts--;
dd->freectxts--; dd->freectxts++;
} }
mutex_unlock(&qib_mutex); mutex_unlock(&qib_mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment