struct ib_send_wr *bad_send_wr; 
static int cm_lap_handler(struct cm_work *work){	struct cm_id_private *cm_id_priv;	struct cm_lap_msg *lap_msg;	struct ib_cm_lap_event_param *param;	struct ib_mad_send_buf *msg = NULL;	struct ib_send_wr *bad_send_wr;	unsigned long flags;	int ret;	/* todo: verify LAP request and send reject APR if invalid. */	lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;	cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,				   lap_msg->local_comm_id);	if (!cm_id_priv)		return -EINVAL;	param = &work->cm_event.param.lap_rcvd;	param->alternate_path = &work->path[0];	cm_format_path_from_lap(param->alternate_path, lap_msg);	work->cm_event.private_data = &lap_msg->private_data;	spin_lock_irqsave(&cm_id_priv->lock, flags);	if (cm_id_priv->id.state != IB_CM_ESTABLISHED)		goto unlock;	switch (cm_id_priv->id.lap_state) {	case IB_CM_LAP_IDLE:		break;	case IB_CM_MRA_LAP_SENT:		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))			goto unlock;		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,			      CM_MSG_RESPONSE_OTHER,			      cm_id_priv->service_timeout,			      cm_id_priv->private_data,			      cm_id_priv->private_data_len);		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		if (ib_post_send_mad(cm_id_priv->av.port->mad_agent,				     &msg->send_wr, &bad_send_wr))			cm_free_msg(msg);		goto deref;	default:		goto unlock;	}	cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;	cm_id_priv->tid = lap_msg->hdr.tid;	ret = atomic_inc_and_test(&cm_id_priv->work_count);	if (!ret)		list_add_tail(&work->list, &cm_id_priv->work_list);	spin_unlock_irqrestore(&cm_id_priv->lock, flags);	if (ret)		cm_process_work(cm_id_priv, work);	else		cm_deref_id(cm_id_priv);	return 0;unlock:	spin_unlock_irqrestore(&cm_id_priv->lock, flags);deref:	cm_deref_id(cm_id_priv);	return -EINVAL;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/34816ad98efe4d47ffd858a0345321f9d85d9420/cm.c/buggy/drivers/infiniband/core/cm.c