diff options
| author | Faisal Latif <faisal.latif@intel.com> | 2010-02-12 22:57:04 +0300 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2010-02-19 22:38:27 +0300 |
| commit | 43093b941283b1b0c30213fe0f4f6f65c94d2d63 (patch) | |
| tree | 2f2979f0bfbac6873768ead95d88e2861e9a568e /drivers/infiniband/hw/nes/nes_cm.c | |
| parent | 6e10d2e407542605b2bdca43dc88c35fa8bd24b2 (diff) | |
| download | linux-43093b941283b1b0c30213fe0f4f6f65c94d2d63.tar.xz | |
RDMA/nes: Fix crash when listener destroyed during loopback setup
When a listener is destroyed and there is an MPA response pending for
loopback connection, the active side cm_node gets destroyed twice:
once in cm_event_connect_error() and again in nes_accept()/nes_reject().
Increment the cm_node's refcount so it's not destroyed by
cm_event_connect_error().
Signed-off-by: Faisal Latif <faisal.latif@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw/nes/nes_cm.c')
| -rw-r--r-- | drivers/infiniband/hw/nes/nes_cm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c index debd92c53d89..2a49ee40b520 100644 --- a/drivers/infiniband/hw/nes/nes_cm.c +++ b/drivers/infiniband/hw/nes/nes_cm.c @@ -1011,9 +1011,10 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core, event.cm_info.loc_port = loopback->loc_port; event.cm_info.cm_id = loopback->cm_id; + add_ref_cm_node(loopback); + loopback->state = NES_CM_STATE_CLOSED; cm_event_connect_error(&event); cm_node->state = NES_CM_STATE_LISTENER_DESTROYED; - loopback->state = NES_CM_STATE_CLOSED; rem_ref_cm_node(cm_node->cm_core, cm_node); |