5 files changed, 31 insertions, 6 deletions

diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 3f89f5e19036..474aa214ab57 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -212,6 +212,7 @@ struct ipoib_path {
 
 struct ipoib_neigh {
         struct ipoib_ah    *ah;
+        union ib_gid        dgid;
         struct sk_buff_head queue;
 
         struct neighbour   *neighbour;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1c6ea1c682a5..cf71d2a5515c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,6 +404,8 @@ static void path_rec_completion(int status,
                 list_for_each_entry(neigh, &path->neigh_list, list) {
                         kref_get(&path->ah->ref);
                         neigh->ah = path->ah;
+                        memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                               sizeof(union ib_gid));
 
                         while ((skb = __skb_dequeue(&neigh->queue)))
                                 __skb_queue_tail(&skqueue, skb);
@@ -510,6 +512,8 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
         if (path->ah) {
                 kref_get(&path->ah->ref);
                 neigh->ah = path->ah;
+                memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                       sizeof(union ib_gid));
 
                 ipoib_send(dev, skb, path->ah,
                            be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
@@ -633,6 +637,25 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 neigh = *to_ipoib_neigh(skb->dst->neighbour);
 
                 if (likely(neigh->ah)) {
+                        if (unlikely(memcmp(&neigh->dgid.raw,
+                                            skb->dst->neighbour->ha + 4,
+                                            sizeof(union ib_gid)))) {
+                                spin_lock(&priv->lock);
+                                /*
+                                 * It's safe to call ipoib_put_ah() inside
+                                 * priv->lock here, because we know that
+                                 * path->ah will always hold one more reference,
+                                 * so ipoib_put_ah() will never do more than
+                                 * decrement the ref count.
+                                 */
+                                ipoib_put_ah(neigh->ah);
+                                list_del(&neigh->list);
+                                ipoib_neigh_free(neigh);
+                                spin_unlock(&priv->lock);
+                                ipoib_path_lookup(skb, dev);
+                                goto out;
+                        }
+
                         ipoib_send(dev, skb, neigh->ah,
                                    be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
                         goto out;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ab40488182b3..b5e6a7be603d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -264,6 +264,10 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                 if (!ah) {
                         ipoib_warn(priv, "ib_address_create failed\n");
                 } else {
+                        spin_lock_irq(&priv->lock);
+                        mcast->ah = ah;
+                        spin_unlock_irq(&priv->lock);
+
                         ipoib_dbg_mcast(priv, "MGID " IPOIB_GID_FMT
                                         " AV %p, LID 0x%04x, SL %d\n",
                                         IPOIB_GID_ARG(mcast->mcmember.mgid),
@@ -271,10 +275,6 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                                         be16_to_cpu(mcast->mcmember.mlid),
                                         mcast->mcmember.sl);
                 }
-
-                spin_lock_irq(&priv->lock);
-                mcast->ah = ah;
-                spin_unlock_irq(&priv->lock);
         }
 
         /* actually send any queued packets */
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index ff117bbf81b4..72febf1f8ff8 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -594,7 +594,7 @@ int iser_reg_page_vec(struct iser_conn     *ib_conn,
         mem  = ib_fmr_pool_map_phys(ib_conn->fmr_pool,
                                     page_list,
                                     page_vec->length,
-                                    &io_addr);
+                                    io_addr);
 
         if (IS_ERR(mem)) {
                 status = (int)PTR_ERR(mem);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 4e22afef7206..8f472e7113b4 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -615,9 +615,10 @@ static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
                                 (sg_dma_address(&scat[i]) & dev->fmr_page_mask) + j;
 
         req->fmr = ib_fmr_pool_map_phys(dev->fmr_pool,
-                                        dma_pages, page_cnt, &io_addr);
+                                        dma_pages, page_cnt, io_addr);
         if (IS_ERR(req->fmr)) {
                 ret = PTR_ERR(req->fmr);
+                req->fmr = NULL;
                 goto out;
         }