[ofw] [PATCH 1/4] ib/cm: fix handling of REJ in REQ_RCVD state

[Sean Hefty]

If a REJ is received immediately after receiving a REQ,
then a callback can be queued to the user for the REJ before
the user has had a chance to see or process the REQ.  The
result is that the user will not have had a chance to set
any context associated with the REQ, which can lead to a
crash processing the REJ.

Signed-off-by: Sean Hefty <sean.hefty at intel.com>
---
This patch should be added for WinOF 2.2 after being committed to the trunk.

 trunk/core/al/kernel/al_cm_cep.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/trunk/core/al/kernel/al_cm_cep.c b/trunk/core/al/kernel/al_cm_cep.c
index 4987207..86c5412 100644
--- a/trunk/core/al/kernel/al_cm_cep.c
+++ b/trunk/core/al/kernel/al_cm_cep.c
@@ -938,7 +938,6 @@ __process_rej(
 		}
 
 		/* Fall through */
-	case CEP_STATE_REQ_RCVD:
 	case CEP_STATE_REP_RCVD:
 	case CEP_STATE_REQ_MRA_SENT:
 	case CEP_STATE_REP_MRA_SENT:
@@ -955,6 +954,13 @@ __process_rej(
 		p_cep->state = CEP_STATE_IDLE;
 		break;
 
+	case CEP_STATE_REQ_RCVD:
+		__remove_cep( p_cep );
+		p_cep->state = CEP_STATE_IDLE;
+		ib_put_mad( p_mad );
+		AL_EXIT( AL_DBG_CM );
+		return IB_NO_MATCH;
+
 	case CEP_STATE_ESTABLISHED:
 	case CEP_STATE_LAP_RCVD:
 	case CEP_STATE_LAP_SENT: