Sean Hefty d0d57ad143 IB/cm: Bump reference count on cm_id before invoking callback ... commit 29963437a4 upstream. When processing a SIDR REQ, the ib_cm allocates a new cm_id. The refcount of the cm_id is initialized to 1. However, cm_process_work will decrement the refcount after invoking all callbacks. The result is that the cm_id will end up with refcount set to 0 by the end of the sidr req handler. If a user tries to destroy the cm_id, the destruction will proceed, under the incorrect assumption that no other threads are referencing the cm_id. This can lead to a crash when the cm callback thread tries to access the cm_id. This problem was noticed as part of a larger investigation with kernel crashes in the rdma_cm when running on a real time OS. Signed-off-by: Sean Hefty <sean.hefty@intel.com> Acked-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2011-04-30 16:53:17 +02:00
..
core	IB/cm: Bump reference count on cm_id before invoking callback	2011-04-30 16:53:17 +02:00
hw	IB/mlx4: Add strong ordering to local inval and fast reg work requests	2009-07-02 16:31:47 -07:00
ulp	IPoIB: Fix world-writable child interface control sysfs attributes	2010-08-02 10:18:51 -07:00
Kconfig	RDMA/nes: Add a driver for NetEffect RNICs	2008-02-04 20:20:45 -08:00
Makefile	RDMA/nes: Add a driver for NetEffect RNICs	2008-02-04 20:20:45 -08:00