summaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/hw
diff options
context:
space:
mode:
authorFaisal Latif <faisal.latif@intel.com>2010-02-12 19:57:04 +0000
committerRoland Dreier <rolandd@cisco.com>2010-02-19 11:38:27 -0800
commit43093b941283b1b0c30213fe0f4f6f65c94d2d63 (patch)
tree2f2979f0bfbac6873768ead95d88e2861e9a568e /drivers/infiniband/hw
parent6e10d2e407542605b2bdca43dc88c35fa8bd24b2 (diff)
RDMA/nes: Fix crash when listener destroyed during loopback setup
When a listener is destroyed and there is an MPA response pending for loopback connection, the active side cm_node gets destroyed twice: once in cm_event_connect_error() and again in nes_accept()/nes_reject(). Increment the cm_node's refcount so it's not destroyed by cm_event_connect_error(). Signed-off-by: Faisal Latif <faisal.latif@intel.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw')
-rw-r--r--drivers/infiniband/hw/nes/nes_cm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index debd92c53d8..2a49ee40b52 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1011,9 +1011,10 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
event.cm_info.loc_port =
loopback->loc_port;
event.cm_info.cm_id = loopback->cm_id;
+ add_ref_cm_node(loopback);
+ loopback->state = NES_CM_STATE_CLOSED;
cm_event_connect_error(&event);
cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
- loopback->state = NES_CM_STATE_CLOSED;
rem_ref_cm_node(cm_node->cm_core,
cm_node);