[patch] infiniband: remove dead code

[patch] infiniband: remove dead code

[Dan Carpenter]

"ret" is initialized to -ENOMEM so we don't need to set it here.

Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>

diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 308d17b..8fa6997 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
+	if (!ib_conn->login_buf)
 		goto alloc_err;
-		ret = -ENOMEM;
-	}
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
+	if (!ib_conn->page_vec)
 		goto alloc_err;
-	}
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch] infiniband: remove dead code

[Thadeu Lima de Souza Cascardo]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

On Mon, Mar 15, 2010 at 11:23:32AM +0300, Dan Carpenter wrote:
> "ret" is initialized to -ENOMEM so we don't need to set it here.
> 
> Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> 
> diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
> index 308d17b..8fa6997 100644
> --- a/drivers/infiniband/ulp/iser/iser_verbs.c
> +++ b/drivers/infiniband/ulp/iser/iser_verbs.c
> @@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
>  	device = ib_conn->device;
>  
>  	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
> -	if (!ib_conn->login_buf) {
> +	if (!ib_conn->login_buf)
>  		goto alloc_err;
> -		ret = -ENOMEM;
> -	}
>  
>  	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
>  				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
> @@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
>  	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
>  				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
>  				    GFP_KERNEL);
> -	if (!ib_conn->page_vec) {
> -		ret = -ENOMEM;
> +	if (!ib_conn->page_vec)
>  		goto alloc_err;
> -	}
> +
>  	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
>  
>  	params.page_shift        = SHIFT_4K;

If there's a failure while allocating page_vec, login_buf will not be
released. A single extra label should solve this.

Regards,
Cascardo.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [patch] infiniband: remove dead code

[Dan Carpenter]

On Mon, Mar 15, 2010 at 11:18:47AM -0300, Thadeu Lima de Souza Cascardo wrote:
> On Mon, Mar 15, 2010 at 11:23:32AM +0300, Dan Carpenter wrote:
> > "ret" is initialized to -ENOMEM so we don't need to set it here.
> > 
> > Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> > 
> > diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
> > index 308d17b..8fa6997 100644
> > --- a/drivers/infiniband/ulp/iser/iser_verbs.c
> > +++ b/drivers/infiniband/ulp/iser/iser_verbs.c
> > @@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
> >  	device = ib_conn->device;
> >  
> >  	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
> > -	if (!ib_conn->login_buf) {
> > +	if (!ib_conn->login_buf)
> >  		goto alloc_err;
> > -		ret = -ENOMEM;
> > -	}
> >  
> >  	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
> >  				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
> > @@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
> >  	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
> >  				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
> >  				    GFP_KERNEL);
> > -	if (!ib_conn->page_vec) {
> > -		ret = -ENOMEM;
> > +	if (!ib_conn->page_vec)
> >  		goto alloc_err;
> > -	}
> > +
> >  	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
> >  
> >  	params.page_shift        = SHIFT_4K;
> 
> If there's a failure while allocating page_vec, login_buf will not be
> released. A single extra label should solve this.
> 
> Regards,
> Cascardo.

Hm...  Actually it looks like we should just remove both those
calls to kfree() and the ib_destroy_fmr_pool().  Otherwise we'll do
a double free when we get to iser_conn_release().

The call tree looks like this:
iser_connect() => iser_cma_handler() => iser_route_handler() 
	=> iser_create_ib_conn_res()

		We fail here and return failures back down the tree.

iser_connect() => iser_conn_release()

		Double free.

I will send a patch for this tomorrow.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch] infiniband: remove dead code

[Or Gerlitz]

On Mon, Mar 15, 2010 at 5:07 PM, Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> Hm...  Actually it looks like we should just remove both those
> calls to kfree() and the ib_destroy_fmr_pool().  Otherwise we'll do
> a double free when we get to iser_conn_release(). [...] I will send a patch for this tomorrow.


Dan, thanks for reporting that. I will be able to look on the problem
and the suggested patch later this week


Or.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch] infiniband: potential double free

[Dan Carpenter]

We shouldn't free things here because we free them later.  The call 
tree looks like this:
iser_connect() => iser_cma_handler() => iser_route_handler()
        => iser_create_ib_conn_res()

                We fail here and return failures back down the tree.

iser_connect() => iser_conn_release()

                Double free.                                                                                                 

Also "ret" is already initialized to -ENOMEM so there is no need to
set that here.

Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>

diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 308d17b..fde2c93 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
-		goto alloc_err;
-		ret = -ENOMEM;
-	}
+	if (!ib_conn->login_buf)
+		goto out_err;
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
-		goto alloc_err;
-	}
+	if (!ib_conn->page_vec)
+		goto out_err;
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;
@@ -183,7 +180,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->fmr_pool = ib_create_fmr_pool(device->pd, &params);
 	if (IS_ERR(ib_conn->fmr_pool)) {
 		ret = PTR_ERR(ib_conn->fmr_pool);
-		goto fmr_pool_err;
+		goto out_err;
 	}
 
 	memset(&init_attr, 0, sizeof init_attr);
@@ -201,7 +198,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 
 	ret = rdma_create_qp(ib_conn->cma_id, device->pd, &init_attr);
 	if (ret)
-		goto qp_err;
+		goto out_err;
 
 	ib_conn->qp = ib_conn->cma_id->qp;
 	iser_err("setting conn %p cma_id %p: fmr_pool %p qp %p\n",
@@ -209,12 +206,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 		 ib_conn->fmr_pool, ib_conn->cma_id->qp);
 	return ret;
 
-qp_err:
-	(void)ib_destroy_fmr_pool(ib_conn->fmr_pool);
-fmr_pool_err:
-	kfree(ib_conn->page_vec);
-	kfree(ib_conn->login_buf);
-alloc_err:
+out_err:
 	iser_err("unable to alloc mem or create resource, err %d\n", ret);
 	return ret;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch] infiniband: potential double free

[Or Gerlitz]

On Tue, Mar 16, 2010 at 10:09 AM, Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> We shouldn't free things here because we free them later.  The call tree looks like this:


Hi Dan, Roland,

We're at a somehow high holiday (e.g Passover) season, and as such I
haven't resolve the issue Dan brought yet. However, all in all this is
--not-- a regression but rather a bug in the error handling code of a
path (synchronous connection establishment) which isn't used (e.g
non_blocking is always true when called by the iscsi stack).

I will make sure to fix the issue for the next merge window, and
actually queue a fixed/reviewed patch (e.g review what Dan works on)
way before that. So in that respect, Roland, you need not to deal with
this directly. Please make sure to cc  linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org on
each related mail, thanks

Or.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html