RDS: Reconnect causes panic at completion phase

The connection can be shutdown while it is processing the
RDMA_CM_EVENT_ESTABLISHED event, and this can lead to panic if the cm_id
has been destroyed.

The fix was to drop the connection if the cm_id has been destroyed.

Orabug: 17213597

Signed-off-by: Richard Frank <richard.frank@oracle.com>
(cherry picked from commit 000fdbea7eab93fc55c45de7302b6560fd41b7f1)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 2982161177f412071bdf495cae51b998f21e4464..11e2a5f831fa18a2bcc46613d384ef0a1fdac743 100644 (file)
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -170,6 +170,12 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                RDS_PROTOCOL_MINOR(conn->c_version),
                ic->i_flowctl ? ", flow control" : "");
 
+       /* The connection might have been dropped under us*/
+       if (!ic->i_cm_id) {
+               rds_conn_drop(conn);
+               return;
+       }
+
        ic->i_sl = ic->i_cm_id->route.path_rec->sl;
 
        /*

diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 407e13166deb13122b7333098b1e1aa56b5f1b50..812d1da86d7d5620be9675c1c5542480d88f0f16 100644 (file)
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -113,9 +113,9 @@ int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                                if (ibic && ibic->i_cm_id == cm_id)
                                        ibic->i_cm_id = NULL;
                                rds_conn_drop(conn);
-                       } else if (conn->c_to_index < (RDS_RDMA_RESOLVE_TO_MAX_INDEX-1))
+                       }
+               } else if (conn->c_to_index < (RDS_RDMA_RESOLVE_TO_MAX_INDEX-1))
                                conn->c_to_index++;
-               }
                break;
 
        case RDMA_CM_EVENT_ROUTE_RESOLVED: