RDMA CM: Avoid possible SEGV during connection shutdown

cma_release_port() may be called twice for the same rdma id during
connection shutdown, causing hlist_del() to SEGV.

Orabug: 16750726

Signed-off-by: Chien-Hua Yen <chien.yen@oracle.com>
(cherry picked from commit cfee888ccacc233d2045a26492ed92a25d468927)

Signed-off-by: Mukesh Kacker <mukesh.kacker@oracle.com>

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index c2445f9047a2ab37c257c03f82c123faa5fba021..f48e4501ef97bb4f88400a3d2b72a39335f32a14 100644 (file)
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1039,13 +1039,16 @@ static void cma_cancel_operation(struct rdma_id_private *id_priv,
 
 static void cma_release_port(struct rdma_id_private *id_priv)
 {
-       struct rdma_bind_list *bind_list = id_priv->bind_list;
-
-       if (!bind_list)
-               return;
+       struct rdma_bind_list *bind_list;
 
        mutex_lock(&lock);
+       bind_list = id_priv->bind_list;
+       if (!bind_list) {
+               mutex_unlock(&lock);
+               return;
+       }
        hlist_del(&id_priv->node);
+       id_priv->bind_list = NULL;
        if (hlist_empty(&bind_list->owners)) {
                idr_remove(bind_list->ps, bind_list->port);
                kfree(bind_list);