9 files changed, 33 insertions, 12 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f72677291b69..a36c94930c31 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         dgid = (union ib_gid *) &addr->sib_addr;
         pkey = ntohs(addr->sib_pkey);
 
+        mutex_lock(&lock);
         list_for_each_entry(cur_dev, &dev_list, list) {
                 for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
                         if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                         cma_dev = cur_dev;
                                         sgid = gid;
                                         id_priv->id.port_num = p;
+                                        goto found;
                                 }
                         }
                 }
         }
-
-        if (!cma_dev)
-                return -ENODEV;
+        mutex_unlock(&lock);
+        return -ENODEV;
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
-        memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+        mutex_unlock(&lock);
+        addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+        memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
         return 0;
 }
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 6eb64c6f0802..c4118bcd5103 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
                 WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
                 if (!uverbs_destroy_uobject(obj, reason))
                         ret = 0;
+                else
+                        atomic_set(&obj->usecnt, 0);
         }
         return ret;
 }
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ec8fb289621f..5f437d1570fb 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
 
+static const struct file_operations ucma_fops;
+
 static inline struct ucma_context *_ucma_find_context(int id,
                                                       struct ucma_file *file)
 {
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
         f = fdget(cmd.fd);
         if (!f.file)
                 return -ENOENT;
+        if (f.file->f_op != &ucma_fops) {
+                ret = -EINVAL;
+                goto file_put;
+        }
 
         /* Validate current fd and prevent destruction of id. */
         ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 823beca448e1..6d974e2363df 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1050,7 +1050,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
         uverbs_dev->num_comp_vectors = device->num_comp_vectors;
 
         if (ib_uverbs_create_uapi(device, uverbs_dev))
-                goto err;
+                goto err_uapi;
 
         cdev_init(&uverbs_dev->cdev, NULL);
         uverbs_dev->cdev.owner = THIS_MODULE;
@@ -1077,11 +1077,10 @@ static void ib_uverbs_add_one(struct ib_device *device)
 
 err_class:
         device_destroy(uverbs_class, uverbs_dev->cdev.dev);
-
 err_cdev:
         cdev_del(&uverbs_dev->cdev);
+err_uapi:
         clear_bit(devnum, dev_map);
-
 err:
         if (atomic_dec_and_test(&uverbs_dev->refcount))
                 ib_uverbs_comp_dev(uverbs_dev);
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index bbfb86eb2d24..bc2b9e038439 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                                 "Failed to destroy Shadow QP");
                         return rc;
                 }
+                bnxt_qplib_free_qp_res(&rdev->qplib_res,
+                                       &rdev->qp1_sqp->qplib_qp);
                 mutex_lock(&rdev->qp_lock);
                 list_del(&rdev->qp1_sqp->list);
                 atomic_dec(&rdev->qp_count);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index e426b990c1dd..6ad0d46ab879 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qplib_res *res,
                                        struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_q *rq = &qp->rq;
-        struct bnxt_qplib_q *sq = &qp->rq;
+        struct bnxt_qplib_q *sq = &qp->sq;
         int rc = 0;
 
         if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index b3203afa3b1d..347fe18b1a41 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1685,6 +1685,12 @@ static void flush_qp(struct c4iw_qp *qhp)
         schp = to_c4iw_cq(qhp->ibqp.send_cq);
 
         if (qhp->ibqp.uobject) {
+
+                /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+                if (qhp->wq.flushed)
+                        return;
+
+                qhp->wq.flushed = 1;
                 t4_set_wq_in_error(&qhp->wq, 0);
                 t4_set_cq_in_error(&rchp->cq);
                 spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ca0f1ee26091..0bbeaaae47e0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -517,9 +517,11 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->page_size_cap       = dev->dev->caps.page_size_cap;
         props->max_qp              = dev->dev->quotas.qp;
         props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
-        props->max_send_sge        = dev->dev->caps.max_sq_sg;
-        props->max_recv_sge        = dev->dev->caps.max_rq_sg;
-        props->max_sge_rd          = MLX4_MAX_SGE_RD;
+        props->max_send_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_recv_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_sge_rd = MLX4_MAX_SGE_RD;
         props->max_cq              = dev->dev->quotas.cq;
         props->max_cqe             = dev->dev->caps.max_cqes;
         props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index ea01b8dd2be6..3d5424f335cb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1027,12 +1027,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id,
 
         skb_queue_head_init(&skqueue);
 
+        netif_tx_lock_bh(p->dev);
         spin_lock_irq(&priv->lock);
         set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
         if (p->neigh)
                 while ((skb = __skb_dequeue(&p->neigh->queue)))
                         __skb_queue_tail(&skqueue, skb);
         spin_unlock_irq(&priv->lock);
+        netif_tx_unlock_bh(p->dev);
 
         while ((skb = __skb_dequeue(&skqueue))) {
                 skb->dev = p->dev;