[ofa-general] crash in ipoib

[Sean Hefty]

I don't know if this is the issue, but here's the code from 
ipoib_cm_req_handler():

	ret = ipoib_cm_send_rep(dev, cm_id, p->qp,
				&event->param.req_rcvd, psn);
	if (ret) {
		ipoib_warn(priv, "failed to send REP: %d\n", ret);
		goto err_rep;
	}

	cm_id->context = p;
	p->jiffies = jiffies;
	p->state = IPOIB_CM_RX_LIVE;
	spin_lock_irq(&priv->lock);
	if (list_empty(&priv->cm.passive_ids))
		queue_delayed_work(ipoib_workqueue,
				   &priv->cm.stale_task,
				   IPOIB_CM_RX_DELAY);
	list_add(&p->list, &priv->cm.passive_ids);
	spin_unlock_irq(&priv->lock);


Note that once the REP is sent, the QP is connected.  Data can be 
received, we can have events, we can be disconnected, whatever... but 
we're not yet on the passive_ids list.

- Sean