[openib-general] potential bug: ipoib freeing ah before completion

[Roland Dreier]

    Michael> It seems that ipoib_flush_paths can be called while
    Michael> completions are still outstanding on IPoIB QP (e.g. from
    Michael> ipoib_ib_dev_flush). If this happens, an address handle
    Michael> might get freed while a work request is still outstanding
    Michael> for it.  This can trigger a local QP error, and IPoIB
    Michael> will stop working, until QP is reset.

So what if path_free is called early?  The address handle shouldn't
get freed until tx_tail is past ah->last_send, so all associated work
requests are complete.  Am I missing something?  Have you actually
seen this happen?