[ewg] [PATCH 02/02] RDMA/nes: listener destroyed during loopback setup crash

[Faisal Latif]

When listener is destroyed and where is MPA response pending for
loopback connection, the active side cm_node gets destroyed in
cm_event_connect_error() and again in nes_accept() and nes_reject().
Increment cm_node's refcount to not be destroyed by cm_event_connect_error().

Signed-off-by: Faisal Latif <faisal.latif at intel.com>
---
 kernel_patches/fixes/nes_0024_loopback_crash.patch |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)
 create mode 100644 kernel_patches/fixes/nes_0024_loopback_crash.patch

diff --git a/kernel_patches/fixes/nes_0024_loopback_crash.patch b/kernel_patches/fixes/nes_0024_loopback_crash.patch
new file mode 100644
index 0000000..b297c70
--- /dev/null
+++ b/kernel_patches/fixes/nes_0024_loopback_crash.patch
@@ -0,0 +1,19 @@
+diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
+index 74544fe..1d99a04 100644
+--- a/drivers/infiniband/hw/nes/nes_cm.c
++++ b/drivers/infiniband/hw/nes/nes_cm.c
+@@ -1012,9 +1012,10 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
+ 					event.cm_info.loc_port =
+ 							 loopback->loc_port;
+ 					event.cm_info.cm_id = loopback->cm_id;
++					add_ref_cm_node(loopback);
++					loopback->state = NES_CM_STATE_CLOSED;
+ 					cm_event_connect_error(&event);
+ 					cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
+-					loopback->state = NES_CM_STATE_CLOSED;
+ 					rem_ref_cm_node(cm_node->cm_core,
+ 							 cm_node);
+
+--
+1.6.0
+
-- 
1.6.0