Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43093b94 authored by Faisal Latif's avatar Faisal Latif Committed by Roland Dreier
Browse files

RDMA/nes: Fix crash when listener destroyed during loopback setup 



When a listener is destroyed and there is an MPA response pending for
loopback connection, the active side cm_node gets destroyed twice:
once in cm_event_connect_error() and again in nes_accept()/nes_reject().

Increment the cm_node's refcount so it's not destroyed by
cm_event_connect_error().

Signed-off-by: default avatarFaisal Latif <faisal.latif@intel.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 6e10d2e4

drivers/infiniband/hw/nes/nes_cm.c

+2 −1
Original line number Diff line number Diff line
@@ -1011,9 +1011,10 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core, 
					event.cm_info.loc_port =

							 loopback->loc_port;

					event.cm_info.cm_id = loopback->cm_id;

					add_ref_cm_node(loopback);

					loopback->state = NES_CM_STATE_CLOSED;

					cm_event_connect_error(&event);

					cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;

					loopback->state = NES_CM_STATE_CLOSED;



					rem_ref_cm_node(cm_node->cm_core,

							 cm_node);