kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [patch] infiniband:  remove dead code
@ 2010-03-15  8:23 Dan Carpenter
  2010-03-15 14:18 ` Thadeu Lima de Souza Cascardo
  0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2010-03-15  8:23 UTC (permalink / raw)
  To: Roland Dreier
  Cc: Sean Hefty, Hal Rosenstock, Or Gerlitz,
	Thadeu Lima de Souza Cascardo, Jiri Kosina,
	linux-rdma-u79uwXL29TY76Z2rM5mHXA,
	kernel-janitors-u79uwXL29TY76Z2rM5mHXA

"ret" is initialized to -ENOMEM so we don't need to set it here.

Signed-off-by: Dan Carpenter <error27@gmail.com>

diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 308d17b..8fa6997 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
+	if (!ib_conn->login_buf)
 		goto alloc_err;
-		ret = -ENOMEM;
-	}
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
+	if (!ib_conn->page_vec)
 		goto alloc_err;
-	}
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;

^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [patch] infiniband:  remove dead code
  2010-03-15  8:23 [patch] infiniband: remove dead code Dan Carpenter
@ 2010-03-15 14:18 ` Thadeu Lima de Souza Cascardo
       [not found]   ` <20100315141846.GA1477-DmMZpsCg3uxeGPcbtGPokg@public.gmane.org>
  0 siblings, 1 reply; 3+ messages in thread
From: Thadeu Lima de Souza Cascardo @ 2010-03-15 14:18 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Roland Dreier, Sean Hefty, Hal Rosenstock, Or Gerlitz,
	Jiri Kosina, linux-rdma-u79uwXL29TY76Z2rM5mHXA,
	kernel-janitors-u79uwXL29TY76Z2rM5mHXA

[-- Attachment #1: Type: text/plain, Size: 1466 bytes --]

On Mon, Mar 15, 2010 at 11:23:32AM +0300, Dan Carpenter wrote:
> "ret" is initialized to -ENOMEM so we don't need to set it here.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> 
> diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
> index 308d17b..8fa6997 100644
> --- a/drivers/infiniband/ulp/iser/iser_verbs.c
> +++ b/drivers/infiniband/ulp/iser/iser_verbs.c
> @@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
>  	device = ib_conn->device;
>  
>  	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
> -	if (!ib_conn->login_buf) {
> +	if (!ib_conn->login_buf)
>  		goto alloc_err;
> -		ret = -ENOMEM;
> -	}
>  
>  	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
>  				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
> @@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
>  	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
>  				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
>  				    GFP_KERNEL);
> -	if (!ib_conn->page_vec) {
> -		ret = -ENOMEM;
> +	if (!ib_conn->page_vec)
>  		goto alloc_err;
> -	}
> +
>  	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
>  
>  	params.page_shift        = SHIFT_4K;

If there's a failure while allocating page_vec, login_buf will not be
released. A single extra label should solve this.

Regards,
Cascardo.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [patch] infiniband:  remove dead code
       [not found]   ` <20100315141846.GA1477-DmMZpsCg3uxeGPcbtGPokg@public.gmane.org>
@ 2010-03-15 15:07     ` Dan Carpenter
  0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2010-03-15 15:07 UTC (permalink / raw)
  To: Thadeu Lima de Souza Cascardo
  Cc: Roland Dreier, Sean Hefty, Hal Rosenstock, Or Gerlitz,
	Jiri Kosina, linux-rdma-u79uwXL29TY76Z2rM5mHXA,
	kernel-janitors-u79uwXL29TY76Z2rM5mHXA

On Mon, Mar 15, 2010 at 11:18:47AM -0300, Thadeu Lima de Souza Cascardo wrote:
> On Mon, Mar 15, 2010 at 11:23:32AM +0300, Dan Carpenter wrote:
> > "ret" is initialized to -ENOMEM so we don't need to set it here.
> > 
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> > 
> > diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
> > index 308d17b..8fa6997 100644
> > --- a/drivers/infiniband/ulp/iser/iser_verbs.c
> > +++ b/drivers/infiniband/ulp/iser/iser_verbs.c
> > @@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
> >  	device = ib_conn->device;
> >  
> >  	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
> > -	if (!ib_conn->login_buf) {
> > +	if (!ib_conn->login_buf)
> >  		goto alloc_err;
> > -		ret = -ENOMEM;
> > -	}
> >  
> >  	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
> >  				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
> > @@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
> >  	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
> >  				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
> >  				    GFP_KERNEL);
> > -	if (!ib_conn->page_vec) {
> > -		ret = -ENOMEM;
> > +	if (!ib_conn->page_vec)
> >  		goto alloc_err;
> > -	}
> > +
> >  	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
> >  
> >  	params.page_shift        = SHIFT_4K;
> 
> If there's a failure while allocating page_vec, login_buf will not be
> released. A single extra label should solve this.
> 
> Regards,
> Cascardo.

Hm...  Actually it looks like we should just remove both those
calls to kfree() and the ib_destroy_fmr_pool().  Otherwise we'll do
a double free when we get to iser_conn_release().

The call tree looks like this:
iser_connect() => iser_cma_handler() => iser_route_handler() 
	=> iser_create_ib_conn_res()

		We fail here and return failures back down the tree.

iser_connect() => iser_conn_release()

		Double free.

I will send a patch for this tomorrow.

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2010-03-15 15:07 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-15  8:23 [patch] infiniband: remove dead code Dan Carpenter
2010-03-15 14:18 ` Thadeu Lima de Souza Cascardo
     [not found]   ` <20100315141846.GA1477-DmMZpsCg3uxeGPcbtGPokg@public.gmane.org>
2010-03-15 15:07     ` Dan Carpenter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).