Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/qib: Correct sense on freectxts increment and decrement
  RDMA/cma: Verify private data length
  IB/mlx4: Fix shutdown crash accessing a non-existent bitmap

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 75ff821c0af07caaef3a0e48c8503489838bd75d..d0d4aa9f480245097b2fab1bd05380c3fe6a01d6 100644 (file)
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2513,6 +2513,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
 
        req.private_data_len = sizeof(struct cma_hdr) +
                               conn_param->private_data_len;
+       if (req.private_data_len < conn_param->private_data_len)
+               return -EINVAL;
+
        req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
        if (!req.private_data)
                return -ENOMEM;
@@ -2562,6 +2565,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
        memset(&req, 0, sizeof req);
        offset = cma_user_data_offset(id_priv->id.ps);
        req.private_data_len = offset + conn_param->private_data_len;
+       if (req.private_data_len < conn_param->private_data_len)
+               return -EINVAL;
+
        private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
        if (!private_data)
                return -ENOMEM;

diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 77f3dbc0aaa1629783bfadb84d0ac5ad754e8207..18836cdf1e1075e6a17895de44c67528a3389169 100644 (file)
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1244,7 +1244,8 @@ err_reg:
 
 err_counter:
        for (; i; --i)
-               mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]);
+               if (ibdev->counters[i - 1] != -1)
+                       mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]);
 
 err_map:
        iounmap(ibdev->uar_map);
@@ -1275,7 +1276,8 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
        }
        iounmap(ibdev->uar_map);
        for (p = 0; p < ibdev->num_ports; ++p)
-               mlx4_counter_free(ibdev->dev, ibdev->counters[p]);
+               if (ibdev->counters[p] != -1)
+                       mlx4_counter_free(ibdev->dev, ibdev->counters[p]);
        mlx4_foreach_port(p, dev, MLX4_PORT_TYPE_IB)
                mlx4_CLOSE_PORT(dev, p);
 

diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 574600ef5b428e4766d8cd431632a0e131c176a9..a7403248d83dee7c14ce9578618872c745fdffcd 100644 (file)
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -1285,7 +1285,7 @@ static int setup_ctxt(struct qib_pportdata *ppd, int ctxt,
        strlcpy(rcd->comm, current->comm, sizeof(rcd->comm));
        ctxt_fp(fp) = rcd;
        qib_stats.sps_ctxts++;
-       dd->freectxts++;
+       dd->freectxts--;
        ret = 0;
        goto bail;
 
@@ -1794,7 +1794,7 @@ static int qib_close(struct inode *in, struct file *fp)
                if (dd->pageshadow)
                        unlock_expected_tids(rcd);
                qib_stats.sps_ctxts--;
-               dd->freectxts--;
+               dd->freectxts++;
        }
 
        mutex_unlock(&qib_mutex);