RDMA/nes: Fix crash when listener destroyed during loopback setup
authorFaisal Latif <faisal.latif@intel.com>
Fri, 12 Feb 2010 19:57:04 +0000 (19:57 +0000)
committerRoland Dreier <rolandd@cisco.com>
Fri, 19 Feb 2010 19:38:27 +0000 (11:38 -0800)
When a listener is destroyed and there is an MPA response pending for
loopback connection, the active side cm_node gets destroyed twice:
once in cm_event_connect_error() and again in nes_accept()/nes_reject().

Increment the cm_node's refcount so it's not destroyed by
cm_event_connect_error().

Signed-off-by: Faisal Latif <faisal.latif@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/hw/nes/nes_cm.c

index debd92c53d893d59c64051977ccff58d2f005e35..2a49ee40b52003e109b039896c773f5c3209d2bd 100644 (file)
@@ -1011,9 +1011,10 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
                                        event.cm_info.loc_port =
                                                         loopback->loc_port;
                                        event.cm_info.cm_id = loopback->cm_id;
+                                       add_ref_cm_node(loopback);
+                                       loopback->state = NES_CM_STATE_CLOSED;
                                        cm_event_connect_error(&event);
                                        cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
-                                       loopback->state = NES_CM_STATE_CLOSED;
 
                                        rem_ref_cm_node(cm_node->cm_core,
                                                         cm_node);