[ofa-general] crash in ipoib

[Michael S. Tsirkin]

> Quoting Roland Dreier <rdreier at cisco.com>:
> Subject: Re: [ofa-general] crash in ipoib
> 
>  > +	ret = ipoib_cm_send_rep(dev, cm_id, p->qp, &event->param.req_rcvd, psn);
>  > +	if (ret) {
>  > +		ipoib_warn(priv, "failed to send REP: %d\n", ret);
>  > +		if (ib_modify_qp(p->qp, &ipoib_cm_err_attr, IB_QP_STATE))
>  > +			ipoib_warn(priv, "unable to move qp to error state\n");
>  > +	}
> 
> So if sending a rep fails, this leaves p on the passive_ids list with
> state IPOIB_CM_RX_LIVE.  Does it ever get cleaned up?

Yes, in the usual way: upon the last wqe reached event.

> The old code used to destroy the qp and free p if sending a REP failed.

This was really a wrong thing to do - destroying QP connected to srq must be
done with the draining procedure, in case the remote violates the protocol
and sends us packets for this QPN.

-- 
MST