3 files changed, 6 insertions, 2 deletions

diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 629a28764da9..42a6f9f20285 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,7 +265,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
                 frmr->page_list->page_list[page_no] =
                         ib_dma_map_single(xprt->sc_cm_id->device,
                                           page_address(rqstp->rq_arg.pages[page_no]),
-                                          PAGE_SIZE, DMA_TO_DEVICE);
+                                          PAGE_SIZE, DMA_FROM_DEVICE);
                 if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                          frmr->page_list->page_list[page_no]))
                         goto fatal_err;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 6c26a675435a..8b510c5e8777 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -183,6 +183,7 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
 
  fatal_err:
         printk("svcrdma: Error fast registering memory for xprt %p\n", xprt);
+        vec->frmr = NULL;
         svc_rdma_put_frmr(xprt, frmr);
         return -EIO;
 }
@@ -516,6 +517,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                        "svcrdma: could not post a receive buffer, err=%d."
                        "Closing transport %p.\n", ret, rdma);
                 set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_frmr(rdma, vec->frmr);
                 svc_rdma_put_context(ctxt, 0);
                 return -ENOTCONN;
         }
@@ -606,6 +608,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
         return 0;
 
  err:
+        svc_rdma_unmap_dma(ctxt);
         svc_rdma_put_frmr(rdma, vec->frmr);
         svc_rdma_put_context(ctxt, 1);
         return -EIO;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 3d810e7df3fb..4b0c2fa15e0b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -520,8 +520,9 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
         svc_xprt_get(&xprt->sc_xprt);
         ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
         if (ret) {
-                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_unmap_dma(ctxt);
                 svc_rdma_put_context(ctxt, 1);
+                svc_xprt_put(&xprt->sc_xprt);
         }
         return ret;