1 From: Stefan Roscher <stefan.roscher@de.ibm.com>
2 Subject: ehca: fix a possible nullpointer access
5 If the initialization of a special QP (e.g. AQP1) fails due to a
6 software timeout, we have to remove the reference to that special
7 QP struct from the port struct preventing the driver to access the
8 QP, since it will be/has been destroyed by the caller, ie in this
11 Acked-by: John Jolly <jjolly@novell.com>
13 Index: linux-2.6.27/drivers/infiniband/hw/ehca/ehca_irq.c
14 ===================================================================
15 --- linux-2.6.27.orig/drivers/infiniband/hw/ehca/ehca_irq.c
16 +++ linux-2.6.27/drivers/infiniband/hw/ehca/ehca_irq.c
17 @@ -359,36 +359,48 @@ static void notify_port_conf_change(stru
21 +/* replay modify_qp for sqps -- return 0 if all is well, 1 if AQP1 destroyed */
22 +static int replay_modify_qp(struct ehca_sport *sport)
25 + unsigned long flags;
27 + spin_lock_irqsave(&sport->mod_sqp_lock, flags);
29 + aqp1_destroyed = !sport->ibqp_sqp[IB_QPT_GSI];
31 + if (sport->ibqp_sqp[IB_QPT_SMI])
32 + ehca_recover_sqp(sport->ibqp_sqp[IB_QPT_SMI]);
33 + if (!aqp1_destroyed)
34 + ehca_recover_sqp(sport->ibqp_sqp[IB_QPT_GSI]);
36 + spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
38 + return aqp1_destroyed;
41 static void parse_ec(struct ehca_shca *shca, u64 eqe)
43 u8 ec = EHCA_BMASK_GET(NEQE_EVENT_CODE, eqe);
44 u8 port = EHCA_BMASK_GET(NEQE_PORT_NUMBER, eqe);
46 struct ehca_sport *sport = &shca->sport[port - 1];
47 - unsigned long flags;
50 case 0x30: /* port availability change */
51 if (EHCA_BMASK_GET(NEQE_PORT_AVAILABILITY, eqe)) {
53 - /* replay modify_qp for sqps */
54 - spin_lock_irqsave(&sport->mod_sqp_lock, flags);
55 - suppress_event = !sport->ibqp_sqp[IB_QPT_GSI];
56 - if (sport->ibqp_sqp[IB_QPT_SMI])
57 - ehca_recover_sqp(sport->ibqp_sqp[IB_QPT_SMI]);
58 - if (!suppress_event)
59 - ehca_recover_sqp(sport->ibqp_sqp[IB_QPT_GSI]);
60 - spin_unlock_irqrestore(&sport->mod_sqp_lock, flags);
62 - /* AQP1 was destroyed, ignore this event */
65 + /* only replay modify_qp calls in autodetect mode;
66 + * if AQP1 was destroyed, the port is already down
67 + * again and we can drop the event.
69 + if (ehca_nr_ports < 0)
70 + if (replay_modify_qp(sport))
73 sport->port_state = IB_PORT_ACTIVE;
74 dispatch_port_event(shca, port, IB_EVENT_PORT_ACTIVE,
76 - ehca_query_sma_attr(shca, port,
77 - &sport->saved_attr);
78 + ehca_query_sma_attr(shca, port, &sport->saved_attr);
80 sport->port_state = IB_PORT_DOWN;
81 dispatch_port_event(shca, port, IB_EVENT_PORT_ERR,
82 Index: linux-2.6.27/drivers/infiniband/hw/ehca/ehca_qp.c
83 ===================================================================
84 --- linux-2.6.27.orig/drivers/infiniband/hw/ehca/ehca_qp.c
85 +++ linux-2.6.27/drivers/infiniband/hw/ehca/ehca_qp.c
86 @@ -854,6 +854,11 @@ static struct ehca_qp *internal_create_q
87 if (qp_type == IB_QPT_GSI) {
88 h_ret = ehca_define_sqp(shca, my_qp, init_attr);
89 if (h_ret != H_SUCCESS) {
90 + kfree(my_qp->mod_qp_parm);
91 + my_qp->mod_qp_parm = NULL;
92 + /* the QP pointer is no longer valid */
93 + shca->sport[init_attr->port_num - 1].ibqp_sqp[qp_type] =
95 ret = ehca2ib_return_code(h_ret);