--- initial
+++ final
@@ -1,110 +1,110 @@
 static int rdma_request(struct p9_client *client, struct p9_req_t *req) {
   struct p9_trans_rdma *rdma = client->trans;
-  struct ib_send_wr wr, *bad_wr;
+  struct ib_send_wr wr;
   struct ib_sge sge;
   int err = 0;
   unsigned long flags;
   struct p9_rdma_context *c = NULL;
   struct p9_rdma_context *rpl_context = NULL;
   /* When an error occurs between posting the recv and the send,
    * there will be a receive context posted without a pending request.
    * Since there is no way to "un-post" it, we remember it and skip
    * post_recv() for the next request.
    * So here,
    * see if we are this `next request' and need to absorb an excess rc.
    * If yes, then drop and free our own, and do not recv_post().
    **/
   if (unlikely(atomic_read(&rdma->excess_rc) > 0)) {
     if ((atomic_sub_return(1, &rdma->excess_rc) >= 0)) {
       /* Got one ! */
       kfree(req->rc);
       req->rc = NULL;
       goto dont_need_post_recv;
     } else {
       /* We raced and lost. */
       atomic_inc(&rdma->excess_rc);
     }
   }
   /* Allocate an fcall for the reply */
   rpl_context = kmalloc(sizeof *rpl_context, GFP_NOFS);
   if (!rpl_context) {
     err = -ENOMEM;
     goto recv_error;
   }
   rpl_context->rc = req->rc;
   /*
    * Post a receive buffer for this request. We need to ensure
    * there is a reply buffer available for every outstanding
    * request. A flushed request can result in no reply for an
    * outstanding request, so we must keep a count to avoid
    * overflowing the RQ.
    */
   if (down_interruptible(&rdma->rq_sem)) {
     err = -EINTR;
     goto recv_error;
   }
   err = post_recv(client, rpl_context);
   if (err) {
     p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n");
     goto recv_error;
   }
   /* remove posted receive buffer from request structure */
   req->rc = NULL;
 dont_need_post_recv:
   /* Post the request */
   c = kmalloc(sizeof *c, GFP_NOFS);
   if (!c) {
     err = -ENOMEM;
     goto send_error;
   }
   c->req = req;
   c->busa = ib_dma_map_single(rdma->cm_id->device, c->req->tc->sdata, c->req->tc->size, DMA_TO_DEVICE);
   if (ib_dma_mapping_error(rdma->cm_id->device, c->busa)) {
     err = -EIO;
     goto send_error;
   }
   c->cqe.done = send_done;
   sge.addr = c->busa;
   sge.length = c->req->tc->size;
   sge.lkey = rdma->pd->local_dma_lkey;
   wr.next = NULL;
   wr.wr_cqe = &c->cqe;
   wr.opcode = IB_WR_SEND;
   wr.send_flags = IB_SEND_SIGNALED;
   wr.sg_list = &sge;
   wr.num_sge = 1;
   if (down_interruptible(&rdma->sq_sem)) {
     err = -EINTR;
     goto send_error;
   }
   /* Mark request as `sent' *before* we actually send it,
    * because doing if after could erase the REQ_STATUS_RCVD
    * status in case of a very fast reply.
    */
   req->status = REQ_STATUS_SENT;
-  err = ib_post_send(rdma->qp, &wr, &bad_wr);
+  err = ib_post_send(rdma->qp, &wr, NULL);
   if (err) goto send_error;
   /* Success */
   return 0;
 /* Handle errors that happened during or while preparing the send: */
 send_error:
   req->status = REQ_STATUS_ERROR;
   kfree(c);
   p9_debug(P9_DEBUG_ERROR, "Error %d in rdma_request()\n", err);
   /* Ach.
    *  We did recv_post(), but not send. We have one recv_post in excess.
    */
   atomic_inc(&rdma->excess_rc);
   return err;
 /* Handle errors that happened during or while preparing post_recv(): */
 recv_error:
   kfree(rpl_context);
   spin_lock_irqsave(&rdma->req_lock, flags);
   if (rdma->state < P9_RDMA_CLOSING) {
     rdma->state = P9_RDMA_CLOSING;
     spin_unlock_irqrestore(&rdma->req_lock, flags);
     rdma_disconnect(rdma->cm_id);
   } else
     spin_unlock_irqrestore(&rdma->req_lock, flags);
   return err;
 }<sep>@@
identifier bad_send_wr;
expression e1,e2,e;
@@

-struct ib_send_wr *bad_send_wr;
<+... when != bad_send_wr
(
-   bad_send_wr = &e;
|
    ib_post_send(e1,e2,
-		   &bad_send_wr
+		   NULL
		)
)
...+>