forked from luck/tmp_suning_uos_patched
IB/mad: Fix ib_post_send_mad() returning 0 with no generate send comp
If ib_post_send_mad() returns 0, the API guarantees that there will be a callback to send_buf->mad_agent->send_handler() so that the sender can call ib_free_send_mad(). Otherwise, the ib_mad_send_buf will be leaked and the mad_agent reference count will never go to zero and the IB device module cannot be unloaded. The above can happen without this patch if process_mad() returns (IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED). If process_mad() returns IB_MAD_RESULT_SUCCESS and there is no agent registered to receive the mad being sent, handle_outgoing_dr_smp() returns zero which causes a MAD packet which is at the end of the directed route to be incorrectly sent on the wire but doesn't cause a hang since the HCA generates a send completion. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
d9620a4c82
commit
4780c1953f
@ -742,9 +742,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
|
||||
break;
|
||||
case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
|
||||
kmem_cache_free(ib_mad_cache, mad_priv);
|
||||
kfree(local);
|
||||
ret = 1;
|
||||
goto out;
|
||||
break;
|
||||
case IB_MAD_RESULT_SUCCESS:
|
||||
/* Treat like an incoming receive MAD */
|
||||
port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
|
||||
@ -755,10 +753,12 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
|
||||
&mad_priv->mad.mad);
|
||||
}
|
||||
if (!port_priv || !recv_mad_agent) {
|
||||
/*
|
||||
* No receiving agent so drop packet and
|
||||
* generate send completion.
|
||||
*/
|
||||
kmem_cache_free(ib_mad_cache, mad_priv);
|
||||
kfree(local);
|
||||
ret = 0;
|
||||
goto out;
|
||||
break;
|
||||
}
|
||||
local->mad_priv = mad_priv;
|
||||
local->recv_mad_agent = recv_mad_agent;
|
||||
|
Loading…
Reference in New Issue
Block a user