[openib-general] [PATCH] [CM] fix CM unload after receiving a bad REQ

[Sean Hefty]

The following patch fixes the issue of unloading the CM after
receiving a bad REQ.

Signed-off-by: Sean Hefty <sean.hefty at intel.com>


Index: cm.c
===================================================================
--- cm.c	(revision 1974)
+++ cm.c	(working copy)
@@ -237,8 +237,8 @@
 {
 	av->port = port;
 	av->pkey_index = wc->pkey_index;
-	cm_set_ah_attr(&av->ah_attr, port->port_num, wc->slid, wc->sl,
-		       wc->dlid_path_bits);
+	cm_set_ah_attr(&av->ah_attr, port->port_num, cpu_to_be16(wc->slid),
+		       wc->sl, wc->dlid_path_bits);
 }
 
 static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
@@ -648,7 +648,7 @@
 		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 		ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT, 
 			       &cm_id_priv->av.port->cm_dev->ca_guid,
-			       sizeof &cm_id_priv->av.port->cm_dev->ca_guid,
+			       sizeof cm_id_priv->av.port->cm_dev->ca_guid,
 			       NULL, 0);
 		break;
 	case IB_CM_ESTABLISHED:
@@ -1038,14 +1038,14 @@
 	if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
 		spin_unlock_irqrestore(&cm.lock, flags);
 		ret = -EINVAL;
-		goto error2;
+		goto error1;
 	}
 	/* Check for a stale connection. */
 	if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
 		spin_unlock_irqrestore(&cm.lock, flags);
 		/* todo: reject as stale */
 		ret = -EINVAL;
-		goto error2;
+		goto error1;
 	}
 	/* Find matching listen request. */
 	listen_cm_id_priv = cm_find_listen(req_msg->service_id);
@@ -1053,7 +1053,7 @@
 		spin_unlock_irqrestore(&cm.lock, flags);
 		/* todo: reject with no match */
 		ret = -EINVAL;
-		goto error2;
+		goto error1;
 	}
 	atomic_inc(&listen_cm_id_priv->refcount);
 	atomic_inc(&cm_id_priv->refcount);
@@ -1069,11 +1069,11 @@
 	cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
 	ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
 	if (ret)
-		goto error3;
+		goto error2;
 	if (req_msg->alt_local_lid) {
 		ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
 		if (ret)
-			goto error3;
+			goto error2;
 	}
 	cm_id_priv->timeout_ms = cm_convert_to_ms(
 					cm_req_get_local_resp_timeout(req_msg));
@@ -1092,11 +1092,9 @@
 	cm_process_work(cm_id_priv, work);
 	cm_deref_id(listen_cm_id_priv);
 	return 0;
-error3:
-	cm_deref_id(listen_cm_id_priv);
 error2:
-	cm_cleanup_timewait(cm_id_priv->timewait_info);
-	kfree(cm_id_priv->timewait_info);
+	atomic_dec(&cm_id_priv->refcount);
+	cm_deref_id(listen_cm_id_priv);
 error1:
 	ib_destroy_cm_id(&cm_id_priv->id);
 	return ret;
@@ -2592,7 +2590,7 @@
 }
 
 static void cm_send_handler(struct ib_mad_agent *mad_agent,
-			 struct ib_mad_send_wc *mad_send_wc)
+			    struct ib_mad_send_wc *mad_send_wc)
 {
 	struct cm_msg *msg;