1 files changed, 27 insertions, 22 deletions

diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index f0d588f8859e..9bdf576cd4ab 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -780,27 +780,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
 {
         struct ib_umad_port *port;
         struct ib_umad_file *file;
-        int ret;
+        int ret = -ENXIO;
 
         port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
-        if (port)
-                kref_get(&port->umad_dev->ref);
-        else
-                return -ENXIO;
 
         mutex_lock(&port->file_mutex);
 
-        if (!port->ib_dev) {
-                ret = -ENXIO;
+        if (!port->ib_dev)
                 goto out;
-        }
 
+        ret = -ENOMEM;
         file = kzalloc(sizeof *file, GFP_KERNEL);
-        if (!file) {
-                kref_put(&port->umad_dev->ref, ib_umad_release_dev);
-                ret = -ENOMEM;
+        if (!file)
                 goto out;
-        }
 
         mutex_init(&file->mutex);
         spin_lock_init(&file->send_lock);
@@ -814,6 +806,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
         list_add_tail(&file->port_list, &port->file_list);
 
         ret = nonseekable_open(inode, filp);
+        if (ret) {
+                list_del(&file->port_list);
+                kfree(file);
+                goto out;
+        }
+
+        kref_get(&port->umad_dev->ref);
 
 out:
         mutex_unlock(&port->file_mutex);
@@ -880,10 +879,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
         int ret;
 
         port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev);
-        if (port)
-                kref_get(&port->umad_dev->ref);
-        else
-                return -ENXIO;
 
         if (filp->f_flags & O_NONBLOCK) {
                 if (down_trylock(&port->sm_sem)) {
@@ -898,17 +893,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
         }
 
         ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props);
-        if (ret) {
-                up(&port->sm_sem);
-                goto fail;
-        }
+        if (ret)
+                goto err_up_sem;
 
         filp->private_data = port;
 
-        return nonseekable_open(inode, filp);
+        ret = nonseekable_open(inode, filp);
+        if (ret)
+                goto err_clr_sm_cap;
+
+        kref_get(&port->umad_dev->ref);
+
+        return 0;
+
+err_clr_sm_cap:
+        swap(props.set_port_cap_mask, props.clr_port_cap_mask);
+        ib_modify_port(port->ib_dev, port->port_num, 0, &props);
+
+err_up_sem:
+        up(&port->sm_sem);
 
 fail:
-        kref_put(&port->umad_dev->ref, ib_umad_release_dev);
         return ret;
 }