10 files changed, 56 insertions, 19 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f6983357145d..6294a7001d33 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4458,7 +4458,7 @@ out:
         return skb->len;
 }
 
-static const struct rdma_nl_cbs cma_cb_table[] = {
+static const struct rdma_nl_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = {
         [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},
 };
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 5e1be4949d5f..30914f3baa5f 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1146,7 +1146,7 @@ struct net_device *ib_get_net_dev_by_params(struct ib_device *dev,
 }
 EXPORT_SYMBOL(ib_get_net_dev_by_params);
 
-static const struct rdma_nl_cbs ibnl_ls_cb_table[] = {
+static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
         [RDMA_NL_LS_OP_RESOLVE] = {
                 .doit = ib_nl_handle_resolve_resp,
                 .flags = RDMA_NL_ADMIN_PERM,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index e9e189ec7502..5d676cff41f4 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -80,7 +80,7 @@ const char *__attribute_const__ iwcm_reject_msg(int reason)
 }
 EXPORT_SYMBOL(iwcm_reject_msg);
 
-static struct rdma_nl_cbs iwcm_nl_cb_table[] = {
+static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
         [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},
         [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},
         [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 2fae850a3eff..9a05245a1acf 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -303,7 +303,7 @@ out:	cb->args[0] = idx;
         return skb->len;
 }
 
-static const struct rdma_nl_cbs nldev_cb_table[] = {
+static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
         [RDMA_NLDEV_CMD_GET] = {
                 .doit = nldev_get_doit,
                 .dump = nldev_get_dumpit,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index a337386652b0..feafdb961c48 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -739,8 +739,11 @@ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
         if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
                 return 0;
 
-        if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
-                return -EACCES;
+        if (map->agent.qp->qp_type == IB_QPT_SMI) {
+                if (!map->agent.smp_allowed)
+                        return -EACCES;
+                return 0;
+        }
 
         return ib_security_pkey_access(map->agent.device,
                                        map->agent.port_num,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 16d55710b116..d0202bb176a4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1971,6 +1971,12 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
+        if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
+            !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+                ret = -EINVAL;
+                goto release_qp;
+        }
+
         attr->qp_state            = cmd->base.qp_state;
         attr->cur_qp_state        = cmd->base.cur_qp_state;
         attr->path_mtu            = cmd->base.path_mtu;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index ea55e95cd2c5..b7bfc536e00f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -395,6 +395,11 @@ next_cqe:
 
 static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
 {
+        if (CQE_OPCODE(cqe) == C4IW_DRAIN_OPCODE) {
+                WARN_ONCE(1, "Unexpected DRAIN CQE qp id %u!\n", wq->sq.qid);
+                return 0;
+        }
+
         if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
                 return 0;
 
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 5ee7fe433136..38bddd02a943 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -868,7 +868,12 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         qhp = to_c4iw_qp(ibqp);
         spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
                 complete_sq_drain_wr(qhp, wr);
                 return err;
@@ -1011,7 +1016,12 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
         qhp = to_c4iw_qp(ibqp);
         spin_lock_irqsave(&qhp->lock, flag);
-        if (t4_wq_in_error(&qhp->wq)) {
+
+        /*
+         * If the qp has been flushed, then just insert a special
+         * drain cqe.
+         */
+        if (qhp->wq.flushed) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
                 complete_rq_drain_wr(qhp, wr);
                 return err;
@@ -1285,21 +1295,21 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
         spin_unlock_irqrestore(&rchp->lock, flag);
 
         if (schp == rchp) {
-                if (t4_clear_cq_armed(&rchp->cq) &&
-                    (rq_flushed || sq_flushed)) {
+                if ((rq_flushed || sq_flushed) &&
+                    t4_clear_cq_armed(&rchp->cq)) {
                         spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                         (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                    rchp->ibcq.cq_context);
                         spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                 }
         } else {
-                if (t4_clear_cq_armed(&rchp->cq) && rq_flushed) {
+                if (rq_flushed && t4_clear_cq_armed(&rchp->cq)) {
                         spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                         (*rchp->ibcq.comp_handler)(&rchp->ibcq,
                                                    rchp->ibcq.cq_context);
                         spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                 }
-                if (t4_clear_cq_armed(&schp->cq) && sq_flushed) {
+                if (sq_flushed && t4_clear_cq_armed(&schp->cq)) {
                         spin_lock_irqsave(&schp->comp_handler_lock, flag);
                         (*schp->ibcq.comp_handler)(&schp->ibcq,
                                                    schp->ibcq.cq_context);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 013049bcdb53..caf490ab24c8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                 return (-EOPNOTSUPP);
         }
 
+        if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4      |
+                                          MLX4_IB_RX_HASH_DST_IPV4      |
+                                          MLX4_IB_RX_HASH_SRC_IPV6      |
+                                          MLX4_IB_RX_HASH_DST_IPV6      |
+                                          MLX4_IB_RX_HASH_SRC_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_TCP  |
+                                          MLX4_IB_RX_HASH_SRC_PORT_UDP  |
+                                          MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+                pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
+                         ucmd->rx_hash_fields_mask);
+                return (-EOPNOTSUPP);
+        }
+
         if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
             (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
                 rss_ctx->flags = MLX4_RSS_IPV4;
@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
                         return (-EOPNOTSUPP);
                 }
 
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                         rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                         rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                         pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
                         return (-EOPNOTSUPP);
                 }
@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
 
         if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
             (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
-                if (rss_ctx->flags & MLX4_RSS_IPV4) {
+                if (rss_ctx->flags & MLX4_RSS_IPV4)
                         rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
-                } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+                if (rss_ctx->flags & MLX4_RSS_IPV6)
                         rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
-                } else {
+                if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
                         pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
                         return (-EOPNOTSUPP);
                 }
-
         } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
                    (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
                 pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 87f4bd99cdf7..2c13123bfd69 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1145,6 +1145,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         noio_flag = memalloc_noio_save();
         p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
         if (!p->tx_ring) {
+                memalloc_noio_restore(noio_flag);
                 ret = -ENOMEM;
                 goto err_tx;
         }