diff options
| author | Steve Wise <swise@opengridcomputing.com> | 2011-05-13 18:37:18 +0000 |
|---|---|---|
| committer | Roland Dreier <roland@purestorage.com> | 2011-05-24 10:01:04 -0700 |
| commit | 807838686eb9e40d73b8a3f2384881358f51fff0 (patch) | |
| tree | 13ab2b82122044054693e949513500bbc8967aef /drivers/infiniband/hw/cxgb3/iwch_qp.c | |
| parent | 257313b2a87795e07a0bdf58d0fffbdba8b31051 (diff) | |
| download | lwn-807838686eb9e40d73b8a3f2384881358f51fff0.tar.gz lwn-807838686eb9e40d73b8a3f2384881358f51fff0.zip | |
RDMA/cxgb3: Don't post zero-byte read if endpoint is going away
tx_ack() wasn't checking the endpoint state and consequently would
attempt to post the p2p 0B read on an endpoint/QP that is closing or
aborting. This causes a NULL pointer dereference crash.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/hw/cxgb3/iwch_qp.c')
| -rw-r--r-- | drivers/infiniband/hw/cxgb3/iwch_qp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c index 1b4cd09f74dc..ecd313f359a4 100644 --- a/drivers/infiniband/hw/cxgb3/iwch_qp.c +++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c @@ -738,7 +738,7 @@ static inline void build_term_codes(struct respQ_msg_t *rsp_msg, } } -int iwch_post_zb_read(struct iwch_qp *qhp) +int iwch_post_zb_read(struct iwch_ep *ep) { union t3_wr *wqe; struct sk_buff *skb; @@ -761,10 +761,10 @@ int iwch_post_zb_read(struct iwch_qp *qhp) wqe->read.local_len = cpu_to_be32(0); wqe->read.local_to = cpu_to_be64(1); wqe->send.wrh.op_seop_flags = cpu_to_be32(V_FW_RIWR_OP(T3_WR_READ)); - wqe->send.wrh.gen_tid_len = cpu_to_be32(V_FW_RIWR_TID(qhp->ep->hwtid)| + wqe->send.wrh.gen_tid_len = cpu_to_be32(V_FW_RIWR_TID(ep->hwtid)| V_FW_RIWR_LEN(flit_cnt)); skb->priority = CPL_PRIORITY_DATA; - return iwch_cxgb3_ofld_send(qhp->rhp->rdev.t3cdev_p, skb); + return iwch_cxgb3_ofld_send(ep->com.qp->rhp->rdev.t3cdev_p, skb); } /* |