3 files changed, 12 insertions, 8 deletions

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 52b1bebfa744..2490b2d79dbb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -38,6 +38,7 @@
 #include <net/icmp.h>
 #include <linux/icmpv6.h>
 #include <linux/delay.h>
+#include <linux/vmalloc.h>
 
 #include "ipoib.h"
 
@@ -637,6 +638,7 @@ static inline int post_send(struct ipoib_dev_priv *priv,
         priv->tx_sge[0].addr          = addr;
         priv->tx_sge[0].length        = len;
 
+        priv->tx_wr.num_sge     = 1;
         priv->tx_wr.wr_id       = wr_id | IPOIB_OP_CM;
 
         return ib_post_send(tx->qp, &priv->tx_wr, &bad_wr);
@@ -1030,13 +1032,13 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         struct ipoib_dev_priv *priv = netdev_priv(p->dev);
         int ret;
 
-        p->tx_ring = kzalloc(ipoib_sendq_size * sizeof *p->tx_ring,
-                                GFP_KERNEL);
+        p->tx_ring = vmalloc(ipoib_sendq_size * sizeof *p->tx_ring);
         if (!p->tx_ring) {
                 ipoib_warn(priv, "failed to allocate tx ring\n");
                 ret = -ENOMEM;
                 goto err_tx;
         }
+        memset(p->tx_ring, 0, ipoib_sendq_size * sizeof *p->tx_ring);
 
         p->qp = ipoib_cm_create_tx_qp(p->dev, p);
         if (IS_ERR(p->qp)) {
@@ -1077,6 +1079,7 @@ err_id:
         ib_destroy_qp(p->qp);
 err_qp:
         p->qp = NULL;
+        vfree(p->tx_ring);
 err_tx:
         return ret;
 }
@@ -1127,7 +1130,7 @@ timeout:
         if (p->qp)
                 ib_destroy_qp(p->qp);
 
-        kfree(p->tx_ring);
+        vfree(p->tx_ring);
         kfree(p);
 }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index f96477a8ca5a..57282048865c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -41,6 +41,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
+#include <linux/vmalloc.h>
 
 #include <linux/if_arp.h>       /* For ARPHRD_xxx */
 
@@ -887,13 +888,13 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
                 goto out;
         }
 
-        priv->tx_ring = kzalloc(ipoib_sendq_size * sizeof *priv->tx_ring,
-                                GFP_KERNEL);
+        priv->tx_ring = vmalloc(ipoib_sendq_size * sizeof *priv->tx_ring);
         if (!priv->tx_ring) {
                 printk(KERN_WARNING "%s: failed to allocate TX ring (%d entries)\n",
                        ca->name, ipoib_sendq_size);
                 goto out_rx_ring_cleanup;
         }
+        memset(priv->tx_ring, 0, ipoib_sendq_size * sizeof *priv->tx_ring);
 
         /* priv->tx_head, tx_tail & tx_outstanding are already 0 */
 
@@ -903,7 +904,7 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         return 0;
 
 out_tx_ring_cleanup:
-        kfree(priv->tx_ring);
+        vfree(priv->tx_ring);
 
 out_rx_ring_cleanup:
         kfree(priv->rx_ring);
@@ -928,7 +929,7 @@ void ipoib_dev_cleanup(struct net_device *dev)
         ipoib_ib_dev_cleanup(dev);
 
         kfree(priv->rx_ring);
-        kfree(priv->tx_ring);
+        vfree(priv->tx_ring);
 
         priv->rx_ring = NULL;
         priv->tx_ring = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 2628339e3a99..31a53c5bcb13 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -650,7 +650,7 @@ void ipoib_mcast_send(struct net_device *dev, void *mgid, struct sk_buff *skb)
          */
         spin_lock(&priv->lock);
 
-        if (!test_bit(IPOIB_MCAST_STARTED, &priv->flags)        ||
+        if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)         ||
             !priv->broadcast                                    ||
             !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &priv->broadcast->flags)) {
                 ++dev->stats.tx_dropped;