[ofw] bug in ipoib ?

[Sean Hefty]

I hit a bug in ipoib that may be worth looking into.  I don't see anything
obviously wrong looking at the debug output (like a NULL pointer somewhere), but
I'm not overly familiar with the code either.

nt!DbgBreakPointWithStatus
nt!KiBugCheckDebugBreak+0x1e
nt!KeBugCheck2+0x640
nt!KeBugCheckEx+0x104
nt!KiBugCheckDispatch+0x74
nt!KiPageFault+0x207
ipoib!cl_qmap_remove_item+0x209
ipoib!__cl_free_trk+0x70
ipoib!cl_qcpool_destroy+0x11e
ipoib!cl_qpool_destroy+0x4a
ipoib!__buf_mgr_destroy+0x174
ipoib!__port_free+0x129
ipoib!__destroy_cb+0x142
ipoib!__destroy_obj+0x146
ipoib!cl_obj_destroy+0x66
ipoib!ipoib_port_destroy+0x16a
ipoib!__ipoib_pnp_cb+0x812
ibbus!__pnp_notify_user+0x865
ibbus!__pnp_process_remove_port+0x35f
ibbus!__pnp_process_remove_ca+0xc3

FAULTING_SOURCE_CODE:  
  1016: 	 * This assignment may modify the parent pointer of the nil
node.
  1017: 	 * This is inconsequential.
  1018: 	 */
  1019: 	p_child->p_up = p_del_item->p_up;
> 1020: 	(*__cl_map_get_parent_ptr_to_item( p_del_item )) = p_child;
  1021: 
  1022: 	if( p_del_item->color != CL_MAP_RED )
  1023: 		__cl_map_del_bal( p_map, p_child );
  1024: 
  1025: 	/*

Please note that this occurred while testing winverbs rdma_cm support.  I have a
modified version of ibbus.sys running on my system, so it's possible that
something in my code led to this issue.  All other code is around SVN 1724.  The
bug occurred after I had installed a new version of the winverb.sys driver and
was executing 'devcon restart =infinibandcontroller'.  (Winverbs was not running
on the system at the time of the crash.)

- Sean