From b4dab7dfefaeff9023f07206b0b5c94ca9dc254e Mon Sep 17 00:00:00 2001 From: Roland Dreier Date: Mon, 27 Jun 2005 14:36:46 -0700 Subject: [PATCH] --- yaml --- r: 3644 b: refs/heads/master c: dae4c1d2362292ccd3318ff67d18aa5c22ee820c h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/infiniband/core/sa_query.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/[refs] b/[refs] index 4a9b9a1649ef..40c48c20837a 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: cae54bdf6f8b643e0e7a36ed531951f19e14fe56 +refs/heads/master: dae4c1d2362292ccd3318ff67d18aa5c22ee820c diff --git a/trunk/drivers/infiniband/core/sa_query.c b/trunk/drivers/infiniband/core/sa_query.c index 276e1a53010d..5a08e81fa827 100644 --- a/trunk/drivers/infiniband/core/sa_query.c +++ b/trunk/drivers/infiniband/core/sa_query.c @@ -507,7 +507,13 @@ static int send_mad(struct ib_sa_query *query, int timeout_ms) spin_unlock_irqrestore(&idr_lock, flags); } - return ret; + /* + * It's not safe to dereference query any more, because the + * send may already have completed and freed the query in + * another context. So use wr.wr_id, which has a copy of the + * query's id. + */ + return ret ? ret : wr.wr_id; } static void ib_sa_path_rec_callback(struct ib_sa_query *sa_query, @@ -598,14 +604,15 @@ int ib_sa_path_rec_get(struct ib_device *device, u8 port_num, rec, query->sa_query.mad->data); *sa_query = &query->sa_query; + ret = send_mad(&query->sa_query, timeout_ms); - if (ret) { + if (ret < 0) { *sa_query = NULL; kfree(query->sa_query.mad); kfree(query); } - return ret ? ret : query->sa_query.id; + return ret; } EXPORT_SYMBOL(ib_sa_path_rec_get); @@ -674,14 +681,15 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num, rec, query->sa_query.mad->data); *sa_query = &query->sa_query; + ret = send_mad(&query->sa_query, timeout_ms); - if (ret) { + if (ret < 0) { *sa_query = NULL; kfree(query->sa_query.mad); kfree(query); } - return ret ? ret : query->sa_query.id; + return ret; } EXPORT_SYMBOL(ib_sa_mcmember_rec_query);