[ofa-general][PATCH] mlx4: FIX error flow when initializing EQ table

[ofa-general][PATCH] mlx4: FIX error flow when initializing EQ table

[Yevgeny Petrilin]

If mlx4_create_eq() would fail for one of EQ's assigned for
completion handling, the code would try to free the same EQ
we failed to create.
The crash was found by Christoph Lameter

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
---
 drivers/net/mlx4/eq.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index 8830dcb..dee1887 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -623,8 +623,10 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
 		err = mlx4_create_eq(dev, dev->caps.num_cqs + MLX4_NUM_SPARE_EQE,
 				     (dev->flags & MLX4_FLAG_MSI_X) ? i : 0,
 				     &priv->eq_table.eq[i]);
-		if (err)
+		if (err) {
+			--i;
 			goto err_out_unmap;
+		}
 	}
 
 	err = mlx4_create_eq(dev, MLX4_NUM_ASYNC_EQE + MLX4_NUM_SPARE_EQE,
-- 
1.6.1.3

Re: [ofa-general][PATCH] mlx4: FIX error flow when initializing EQ table

[David Miller]

From: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Date: Sun, 07 Jun 2009 18:16:09 +0300

> If mlx4_create_eq() would fail for one of EQ's assigned for
> completion handling, the code would try to free the same EQ
> we failed to create.
> The crash was found by Christoph Lameter
> 
> Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>

Applied, thanks.

Re: [ofa-general][PATCH] mlx4: FIX error flow when initializing EQ table

[Roland Dreier]

 > If mlx4_create_eq() would fail for one of EQ's assigned for
 > completion handling, the code would try to free the same EQ
 > we failed to create.
 > The crash was found by Christoph Lameter

Thanks, good catch.  However looking at the code it seems that a simpler
way to fix this would be as below.  Can you confirm that this works too?
---
 drivers/net/mlx4/eq.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index 8830dcb..033817e 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -677,12 +677,12 @@ err_out_async:
 	mlx4_free_eq(dev, &priv->eq_table.eq[dev->caps.num_comp_vectors]);
 
 err_out_comp:
-	i = dev->caps.num_comp_vectors - 1;
+	i = dev->caps.num_comp_vectors;
 
 err_out_unmap:
-	while (i >= 0) {
-		mlx4_free_eq(dev, &priv->eq_table.eq[i]);
+	while (i > 0) {
 		--i;
+		mlx4_free_eq(dev, &priv->eq_table.eq[i]);
 	}
 	mlx4_unmap_clr_int(dev);
 	mlx4_free_irqs(dev);

Re: [ofa-general][PATCH] mlx4: FIX error flow when initializing EQ table

[Yevgeny Petrilin]

Roland Dreier wrote:
>  > If mlx4_create_eq() would fail for one of EQ's assigned for
>  > completion handling, the code would try to free the same EQ
>  > we failed to create.
>  > The crash was found by Christoph Lameter
> 
> Thanks, good catch.  However looking at the code it seems that a simpler
> way to fix this would be as below.  Can you confirm that this works too?
> ---
>  drivers/net/mlx4/eq.c |    6 +++---
>  1 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
> index 8830dcb..033817e 100644
> --- a/drivers/net/mlx4/eq.c
> +++ b/drivers/net/mlx4/eq.c
> @@ -677,12 +677,12 @@ err_out_async:
>  	mlx4_free_eq(dev, &priv->eq_table.eq[dev->caps.num_comp_vectors]);
>  
>  err_out_comp:
> -	i = dev->caps.num_comp_vectors - 1;
> +	i = dev->caps.num_comp_vectors;
>  
>  err_out_unmap:
> -	while (i >= 0) {
> -		mlx4_free_eq(dev, &priv->eq_table.eq[i]);
> +	while (i > 0) {
>  		--i;
> +		mlx4_free_eq(dev, &priv->eq_table.eq[i]);
>  	}
>  	mlx4_unmap_clr_int(dev);
>  	mlx4_free_irqs(dev);
> 
Yes, it also works
Yevgeny