Always return valid bad_wr on error from ibv_post_{send,recv,srq_recv}

There are error cases in the kernel's uverbs work request posting
functions where the return value is negative (i.e., an error) and yet a
non-zero resp.bad_wr is not written back to userspace.  In this case,
ibv_cmd_post_send() should still set the bad_wr pointer.

Bug pointed out in ibv_post_send() by Ralph Campbell
<ralph.campbell@qlogic.com>, and noticed elsewhere by Dotan Barak
<dotanb@dev.mellanox.co.il>.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/src/cmd.c b/src/cmd.c
index 6d4331f7552f899096dfe3fd903a4d4428e6aa67..31b592e92101e0a8db4e964b1c5d67c57e300009 100644 (file)
--- a/src/cmd.c
+++ b/src/cmd.c
@@ -884,7 +884,8 @@ int ibv_cmd_post_send(struct ibv_qp *ibqp, struct ibv_send_wr *wr,
                while (--wr_count)
                        i = i->next;
                *bad_wr = i;
-       }
+       } else if (ret)
+               *bad_wr = wr;
 
        return ret;
 }
@@ -944,7 +945,8 @@ int ibv_cmd_post_recv(struct ibv_qp *ibqp, struct ibv_recv_wr *wr,
                while (--wr_count)
                        i = i->next;
                *bad_wr = i;
-       }
+       } else if (ret)
+               *bad_wr = wr;
 
        return ret;
 }
@@ -1004,7 +1006,8 @@ int ibv_cmd_post_srq_recv(struct ibv_srq *srq, struct ibv_recv_wr *wr,
                while (--wr_count)
                        i = i->next;
                *bad_wr = i;
-       }
+       } else if (ret)
+               *bad_wr = wr;
 
        return ret;
 }