From 04e74cfefb6ee43d3f08f262a6d14b2df67af899 Mon Sep 17 00:00:00 2001
From: Faisal Latif <faisal.latif@intel.com>
Date: Wed, 8 Apr 2009 14:22:20 -0700
Subject: [PATCH] --- yaml --- r: 142948 b: refs/heads/master c:
 79fc3d7410c861c8ced5b81a5c3759f6bbf891dc h: refs/heads/master v: v3

---
 [refs]                                   | 2 +-
 trunk/drivers/infiniband/hw/nes/nes_cm.c | 8 ++++++--
 trunk/drivers/infiniband/hw/nes/nes_cm.h | 1 -
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index 4faafc587e4d..f6df8de7dfc5 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7a5efb62f6ae366cefac6be475434906c5061e15
+refs/heads/master: 79fc3d7410c861c8ced5b81a5c3759f6bbf891dc
diff --git a/trunk/drivers/infiniband/hw/nes/nes_cm.c b/trunk/drivers/infiniband/hw/nes/nes_cm.c
index 7c942470b980..a09caf5b387d 100644
--- a/trunk/drivers/infiniband/hw/nes/nes_cm.c
+++ b/trunk/drivers/infiniband/hw/nes/nes_cm.c
@@ -426,6 +426,7 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
 	if (type == NES_TIMER_TYPE_CLOSE) {
 		new_send->timetosend += (HZ/10);
 		if (cm_node->recv_entry) {
+			kfree(new_send);
 			WARN_ON(1);
 			return -EINVAL;
 		}
@@ -1262,7 +1263,6 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
 		cm_node->nesqp = NULL;
 	}
 
-	cm_node->freed = 1;
 	kfree(cm_node);
 	return 0;
 }
@@ -1999,13 +1999,17 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
 		if (loopbackremotelistener == NULL) {
 			create_event(cm_node, NES_CM_EVENT_ABORTED);
 		} else {
-			atomic_inc(&cm_loopbacks);
 			loopback_cm_info = *cm_info;
 			loopback_cm_info.loc_port = cm_info->rem_port;
 			loopback_cm_info.rem_port = cm_info->loc_port;
 			loopback_cm_info.cm_id = loopbackremotelistener->cm_id;
 			loopbackremotenode = make_cm_node(cm_core, nesvnic,
 				&loopback_cm_info, loopbackremotelistener);
+			if (!loopbackremotenode) {
+				rem_ref_cm_node(cm_node->cm_core, cm_node);
+				return NULL;
+			}
+			atomic_inc(&cm_loopbacks);
 			loopbackremotenode->loopbackpartner = cm_node;
 			loopbackremotenode->tcp_cntxt.rcv_wscale =
 				NES_CM_DEFAULT_RCV_WND_SCALE;
diff --git a/trunk/drivers/infiniband/hw/nes/nes_cm.h b/trunk/drivers/infiniband/hw/nes/nes_cm.h
index d5f778202eb7..80bba1892571 100644
--- a/trunk/drivers/infiniband/hw/nes/nes_cm.h
+++ b/trunk/drivers/infiniband/hw/nes/nes_cm.h
@@ -298,7 +298,6 @@ struct nes_cm_node {
 	struct nes_vnic           *nesvnic;
 	int                       apbvt_set;
 	int                       accept_pend;
-	int			freed;
 	struct list_head	timer_entry;
 	struct list_head	reset_entry;
 	struct nes_qp		*nesqp;