Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  mlx4_core: Fix thinko in QP destroy (incorrect bitmap_free)
  RDMA/cxgb3: Set the max_qp_init_rd_atom attribute in query_device
  IB/ehca: Fix static rate calculation
  IB/ehca: Return physical link information in query_port()
  IB/ipath: Fix race with ACK retry timeout list management
  IB/ipath: Fix memory leak in ipath_resize_cq() if copy_to_user() fails
  mlx4_core: Fix possible bad free in mlx4_buf_free()

2 files changed, 5 insertions, 4 deletions

diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index f8d63d39f592..b226e019bc8b 100644
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -171,9 +171,10 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf)
                                   buf->u.direct.map);
         else {
                 for (i = 0; i < buf->nbufs; ++i)
-                        dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                          buf->u.page_list[i].buf,
-                                          buf->u.page_list[i].map);
+                        if (buf->u.page_list[i].buf)
+                                dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
+                                                  buf->u.page_list[i].buf,
+                                                  buf->u.page_list[i].map);
                 kfree(buf->u.page_list);
         }
 }
diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c
index cc4b1be18219..42b47639c81c 100644
--- a/drivers/net/mlx4/qp.c
+++ b/drivers/net/mlx4/qp.c
@@ -240,7 +240,7 @@ void mlx4_qp_free(struct mlx4_dev *dev, struct mlx4_qp *qp)
         mlx4_table_put(dev, &qp_table->auxc_table, qp->qpn);
         mlx4_table_put(dev, &qp_table->qp_table, qp->qpn);
 
-        if (qp->qpn < dev->caps.sqp_start + 8)
+        if (qp->qpn >= dev->caps.sqp_start + 8)
                 mlx4_bitmap_free(&qp_table->bitmap, qp->qpn);
 }
 EXPORT_SYMBOL_GPL(mlx4_qp_free);