9P: Fix fcall allocation for rdma

The current code assumes that when a request in the request array
does have a tc, it also has a rc.

This is normally true, but not always : when using RDMA, req->rc
will temporarily be set to NULL after the request has been sent.
That is usually OK though, as when the reply arrives, req->rc will be
reassigned to a sane value before the request is recycled.

But there is a catch : if the request is flushed, the reply will never
arrive, and req->rc will be NULL, but not req->tc.

This patch fixes p9_tag_alloc to take this into account.

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

diff --git a/net/9p/client.c b/net/9p/client.c
index 01f1779eba805c0e32192280cbd73be6500aab08..5828769d1f3d37f31602f330c0eb7be0d73319ea 100644 (file)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -258,27 +258,25 @@ p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size)
        req = &c->reqs[row][col];
        if (!req->tc) {
                req->wq = kmalloc(sizeof(wait_queue_head_t), GFP_NOFS);
-               if (!req->wq) {
-                       pr_err("Couldn't grow tag array\n");
-                       return ERR_PTR(-ENOMEM);
-               }
+               if (!req->wq)
+                       goto grow_failed;
+
                init_waitqueue_head(req->wq);
                req->tc = kmalloc(sizeof(struct p9_fcall) + alloc_msize,
                                  GFP_NOFS);
+               if (!req->tc)
+                       goto grow_failed;
+
+               req->tc->capacity = alloc_msize;
+               req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
+       }
+       if (!req->rc) {
                req->rc = kmalloc(sizeof(struct p9_fcall) + alloc_msize,
                                  GFP_NOFS);
-               if ((!req->tc) || (!req->rc)) {
-                       pr_err("Couldn't grow tag array\n");
-                       kfree(req->tc);
-                       kfree(req->rc);
-                       kfree(req->wq);
-                       req->tc = req->rc = NULL;
-                       req->wq = NULL;
-                       return ERR_PTR(-ENOMEM);
-               }
-               req->tc->capacity = alloc_msize;
+               if (!req->rc)
+                       goto grow_failed;
+
                req->rc->capacity = alloc_msize;
-               req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
                req->rc->sdata = (char *) req->rc + sizeof(struct p9_fcall);
        }
 
@@ -288,7 +286,16 @@ p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size)
        req->tc->tag = tag-1;
        req->status = REQ_STATUS_ALLOC;
 
-       return &c->reqs[row][col];
+       return req;
+
+grow_failed:
+       pr_err("Couldn't grow tag array\n");
+       kfree(req->tc);
+       kfree(req->rc);
+       kfree(req->wq);
+       req->tc = req->rc = NULL;
+       req->wq = NULL;
+       return ERR_PTR(-ENOMEM);
 }
 
 /**