[openib-general] CM oops in cm_free_msg()

[Libor Michalek]

Sean,

  I'm seeing the following Oops on both passive and active connects.
On active side it's around theend of the REP callback, or the sending
of the RTU. On the passive side it appears to be around the sending
of the REP or receiving of the RTU.

  On another note, calling ib_cm_establish from CQ callback context, I
would expect to see a callback from the CM that I've entered ESTABLISHED
state, but looking at the code, that does not appear to be the case. Is
this something that wasn't intended, or just isn't there yet?
 
-Libor


Oops: 0000 [#1]
SMP 
Modules linked in: ib_sdp ib_ipoib ib_cm ib_umad ib_sa ib_mthca ib_mad ib_core ipv6 parport_pc lp parport autofs4 e1000 af_packet ide_cd cdrom sg microcode dm_mod uhci_hcd usbcore video thermal processor fan button battery ac ext3 jbd
CPU:    3
EIP:    0060:[<f8a34961>]    Tainted: GF     VLI
EFLAGS: 00010292   (2.6.10) 
EIP is at ib_destroy_ah+0x1/0x20 [ib_core]
eax: 00000292   ebx: f536de24   ecx: f5bd9c00   edx: 00000000
esi: f67ba980   edi: f5bdbf14   ebp: 00000292   esp: f5bdbec0
ds: 007b   es: 007b   ss: 0068
Process ib_mad1 (pid: 3744, threadinfo=f5bda000 task=f5b75020)
Stack: f536de24 f8aaa0f1 f5bdbf14 f5bd9c80 f8a63452 00000286 f5bd9c80 f6d432fc 
       00000000 f5bd9c80 f8a6354a 00000001 00000282 f6d432f4 f5bdbf14 f5fe0e00 
       f56da800 f6d43200 f5bdbf14 00000212 f8a63729 f536de24 00000000 00000000 
Call Trace:
 [<f8aaa0f1>] cm_free_msg+0x11/0x50 [ib_cm]
 [<f8a63452>] ib_mad_complete_send_wr+0xf2/0x140 [ib_mad]
 [<f8a6354a>] ib_mad_send_done_handler+0xaa/0x110 [ib_mad]
 [<f8a63729>] ib_mad_completion_handler+0x59/0x80 [ib_mad]
 [<c01339fa>] remove_wait_queue+0x1a/0x50
 [<c012f87d>] worker_thread+0x1bd/0x260
 [<f8a636d0>] ib_mad_completion_handler+0x0/0x80 [ib_mad]
 [<c011c2b0>] default_wake_function+0x0/0x10
 [<c011c2b0>] default_wake_function+0x0/0x10
 [<c012f6c0>] worker_thread+0x0/0x260
 [<c01336ec>] kthread+0x9c/0xb0
 [<c0133650>] kthread+0x0/0xb0
 [<c01022dd>] kernel_thread_helper+0x5/0x18
Code: 89 d8 ff d1 eb f8 8d 74 26 00 53 89 c3 8b 00 8b 88 ac 00 00 00 85 c9 75 07 b8 da ff ff ff 5b c3 89 d8 ff d1 eb f8 8d 74 26 00 53 <8b> 10 8b 58 04 ff 92 b0 00 00 00 85 c0 75 04 f0 ff 4b 04 5b c3