[ofa-general] crash in ipoib

[Roland Dreier]

 > +	ret = ipoib_cm_send_rep(dev, cm_id, p->qp, &event->param.req_rcvd, psn);
 > +	if (ret) {
 > +		ipoib_warn(priv, "failed to send REP: %d\n", ret);
 > +		if (ib_modify_qp(p->qp, &ipoib_cm_err_attr, IB_QP_STATE))
 > +			ipoib_warn(priv, "unable to move qp to error state\n");
 > +	}

So if sending a rep fails, this leaves p on the passive_ids list with
state IPOIB_CM_RX_LIVE.  Does it ever get cleaned up?

The old code used to destroy the qp and free p if sending a REP failed.

 - R.