Steve Wise 6b59ba609b RDMA/iwcm: Don't touch cm_id after deref in rem_ref ... rem_ref() calls iwcm_deref_id(), which will wake up any blockers on cm_id_priv->destroy_comp if the refcnt hits 0. That will unblock someone in iw_destroy_cm_id() which will free the cmid. If that happens before rem_ref() calls test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags), then the test_bit() will touch freed memory. The fix is to read the bit first, then deref. We should never be in iw_destroy_cm_id() with IWCM_F_CALLBACK_DESTROY set, and there is a BUG_ON() to make sure of that. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Roland Dreier <roland@purestorage.com>		2013-12-15 16:47:47 -08:00
..
addr.c	IB/addr: Add AF_IB support to ip_addr_size	2013-06-20 13:08:02 -07:00
agent.c	IB/mad: Improve an error message so error code is included	2011-03-18 09:42:20 -07:00
agent.h	RDMA: Remove subversion $Id tags	2008-07-14 23:48:44 -07:00
cache.c	IB/core: Add ib_find_exact_cached_pkey()	2012-09-30 20:33:30 -07:00
cm_msgs.h	IB/core: Move CM_xxx_ATTR_ID macros from cm_msgs.h to ib_cm.h	2012-07-08 18:05:06 -07:00
cm.c	IB/cm: Convert to using idr_alloc_cyclic()	2013-11-16 10:30:42 -08:00
cma.c	Main batch of InfiniBand/RDMA changes for 3.13:	2013-11-18 15:36:04 -08:00
core_priv.h	IB/core: Allow device-specific per-port sysfs files	2010-05-21 10:34:44 -07:00
device.c	IB/core: Handle table with full and partial membership for the same P_Key	2012-09-30 20:33:29 -07:00
fmr_pool.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
iwcm.c	RDMA/iwcm: Don't touch cm_id after deref in rem_ref	2013-12-15 16:47:47 -08:00
iwcm.h
mad_priv.h	IB/mad: Allow tuning of QP0 and QP1 sizes	2009-09-07 08:28:48 -07:00
mad_rmpp.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
mad_rmpp.h	RDMA: Remove subversion $Id tags	2008-07-14 23:48:44 -07:00
mad.c	IB/core: Create QP1 using the pkey index which contains the default pkey	2013-07-31 14:15:17 -07:00
Makefile	RDMA: Add netlink infrastructure	2011-05-20 11:46:11 -07:00
multicast.c	infiniband: add in export.h for files using EXPORT_SYMBOL/THIS_MODULE	2011-10-31 19:31:35 -04:00
netlink.c	IB/netlink: Remove superfluous RDMA_NL_GET_OP() masking	2013-11-08 14:42:54 -08:00
packer.c	infiniband: add in export.h for files using EXPORT_SYMBOL/THIS_MODULE	2011-10-31 19:31:35 -04:00
sa_query.c	IB/sa: Export function to pack a path record into wire format	2013-06-20 23:35:39 -07:00
sa.h
smi.c	IB/mad: Check hop count field in directed route MAD to avoid array overflow	2009-09-05 20:24:10 -07:00
smi.h
sysfs.c	IB/core: Add Cisco usNIC rdma node and transport types	2013-11-09 02:36:25 -08:00
ucm.c	IB/core: convert to idr_alloc()	2013-02-27 19:10:16 -08:00
ucma.c	Merge branches 'cma', 'cxgb4', 'flowsteer', 'ipoib', 'misc', 'mlx4', 'mlx5', 'nes', 'ocrdma', 'qib' and 'srp' into for-next	2013-11-17 08:22:19 -08:00
ud_header.c	infiniband: add in export.h for files using EXPORT_SYMBOL/THIS_MODULE	2011-10-31 19:31:35 -04:00
umem.c	IB/core: Fix mismatch between locked and pinned pages	2012-05-11 11:38:22 -07:00
user_mad.c	switch device_get_devnode() and ->devnode() to umode_t *	2012-01-03 22:54:55 -05:00
uverbs_cmd.c	Merge branches 'cma', 'cxgb4', 'flowsteer', 'ipoib', 'misc', 'mlx4', 'mlx5', 'nes', 'ocrdma', 'qib' and 'srp' into for-next	2013-11-17 08:22:19 -08:00
uverbs_main.c	IB/core: Re-enable create_flow/destroy_flow uverbs	2013-11-17 08:22:09 -08:00
uverbs_marshall.c	infiniband: add in export.h for files using EXPORT_SYMBOL/THIS_MODULE	2011-10-31 19:31:35 -04:00
uverbs.h	IB/core: Re-enable create_flow/destroy_flow uverbs	2013-11-17 08:22:09 -08:00
verbs.c	IB/core: Encorce MR access rights rules on kernel consumers	2013-11-15 10:25:32 -08:00