cm_id_priv->timewait_info = NULL; 
static int cm_req_handler(struct cm_work *work){	struct ib_cm_id *cm_id;	struct cm_id_private *cm_id_priv, *listen_cm_id_priv;	struct cm_req_msg *req_msg;	int ret;	req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;	cm_id = ib_create_cm_id(NULL, NULL);	if (IS_ERR(cm_id))		return PTR_ERR(cm_id);	cm_id_priv = container_of(cm_id, struct cm_id_private, id);	cm_id_priv->id.remote_id = req_msg->local_comm_id;	cm_init_av_for_response(work->port, work->mad_recv_wc->wc,				&cm_id_priv->av);	cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->							    id.local_id);	if (IS_ERR(cm_id_priv->timewait_info)) {		ret = PTR_ERR(cm_id_priv->timewait_info);		goto error1;	}	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;	cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;	cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);	listen_cm_id_priv = cm_match_req(work, cm_id_priv);	if (!listen_cm_id_priv) {		ret = -EINVAL;		goto error2;	}	cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;	cm_id_priv->id.context = listen_cm_id_priv->id.context;	cm_id_priv->id.service_id = req_msg->service_id;	cm_id_priv->id.service_mask = __constant_cpu_to_be64(~0ULL);	cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);	ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);	if (ret)		goto error3;	if (req_msg->alt_local_lid) {		ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);		if (ret)			goto error3;	}	cm_id_priv->tid = req_msg->hdr.tid;	cm_id_priv->timeout_ms = cm_convert_to_ms(					cm_req_get_local_resp_timeout(req_msg));	cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);	cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);	cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);	cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);	cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);	cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);	cm_id_priv->local_ack_timeout =				cm_req_get_primary_local_ack_timeout(req_msg);	cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);	cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);	cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);	cm_process_work(cm_id_priv, work);	cm_deref_id(listen_cm_id_priv);	return 0;error3:	atomic_dec(&cm_id_priv->refcount);	cm_deref_id(listen_cm_id_priv);	cm_cleanup_timewait(cm_id_priv->timewait_info);error2:	kfree(cm_id_priv->timewait_info);error1:	ib_destroy_cm_id(&cm_id_priv->id);	return ret;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/1b205c2d2464bfecbba80227e74b412596dc5521/cm.c/buggy/drivers/infiniband/core/cm.c