Hello Wei Hu (Xavier), The patch 6a04aed6afae: "RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset" from Feb 3, 2019, leads to the following static checker warning: drivers/infiniband/hw/hns/hns_roce_qp.c:940 hns_roce_create_qp() error: passing non negative 2 to ERR_PTR drivers/infiniband/hw/hns/hns_roce_qp.c 930 hr_qp->ibqp.qp_num = HNS_ROCE_MAX_PORTS + 931 hr_dev->iboe.phy_port[hr_qp->port]; 932 else 933 hr_qp->ibqp.qp_num = 1; 934 935 ret = hns_roce_create_qp_common(hr_dev, pd, init_attr, udata, 936 hr_qp->ibqp.qp_num, hr_qp); 937 if (ret) { 938 dev_err(dev, "Create GSI QP failed!\n"); 939 kfree(hr_sqp); --> 940 return ERR_PTR(ret); 941 } 942 943 break; 944 } 945 default:{ 946 dev_err(dev, "not support QP type %d\n", init_attr->qp_type); 947 return ERR_PTR(-EINVAL); 948 } 949 } 950 951 return &hr_qp->ibqp; 952 } The number 2 comes from hns_roce_cmq_send(). drivers/infiniband/hw/hns/hns_roce_hw_v2 1089 int hns_roce_cmq_send(struct hns_roce_dev *hr_dev, 1090 struct hns_roce_cmq_desc *desc, int num) 1091 { 1092 int retval; 1093 int ret; 1094 1095 ret = hns_roce_v2_rst_process_cmd(hr_dev); 1096 if (ret == CMD_RST_PRC_SUCCESS) 1097 return 0; 1098 if (ret == CMD_RST_PRC_EBUSY) 1099 return ret; ^^^^^^^^^^ 1100 1101 ret = __hns_roce_cmq_send(hr_dev, desc, num); 1102 if (ret) { 1103 retval = hns_roce_v2_rst_process_cmd(hr_dev); 1104 if (retval == CMD_RST_PRC_SUCCESS) 1105 return 0; 1106 else if (retval == CMD_RST_PRC_EBUSY) 1107 return retval; ^^^^^^^^^^^^^ These should probably be -EBUSY. 1108 } 1109 1110 return ret; 1111 } regards, dan carpenter