IPoIB/cm: Fix ipoib_cm_dev_stop() cleanup when drain times out

Commit efcd9971 ("IPoIB/cm: Factor out ipoib_cm_free_rx_reap_list()")
introduced a bug in ipoib_cm_dev_stop() when the receive drain times
out.  In that case, the function moves all the pending rx stuff into a
private list but then calls ipoib_cm_free_rx_reap_list(), which
handles a different list.

Fix this by moving everything to the rx_reap_list that will actually
get freed up.

This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=906>.

Signed-off-by: Pradeep Satyanarayana <pradeeps@linux.vnet.ibm.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 7dd2ec473d24e297950aefffee9609959301b51f..52b1bebfa74482dc2586667e6c35c68f4b5e5c04 100644 (file)
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -824,7 +824,6 @@ void ipoib_cm_dev_stop(struct net_device *dev)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_cm_rx *p;
        unsigned long begin;
-       LIST_HEAD(list);
        int ret;
 
        if (!IPOIB_CM_SUPPORTED(dev->dev_addr) || !priv->cm.id)
@@ -857,9 +856,12 @@ void ipoib_cm_dev_stop(struct net_device *dev)
                        /*
                         * assume the HW is wedged and just free up everything.
                         */
-                       list_splice_init(&priv->cm.rx_flush_list, &list);
-                       list_splice_init(&priv->cm.rx_error_list, &list);
-                       list_splice_init(&priv->cm.rx_drain_list, &list);
+                       list_splice_init(&priv->cm.rx_flush_list,
+                                        &priv->cm.rx_reap_list);
+                       list_splice_init(&priv->cm.rx_error_list,
+                                        &priv->cm.rx_reap_list);
+                       list_splice_init(&priv->cm.rx_drain_list,
+                                        &priv->cm.rx_reap_list);
                        break;
                }
                spin_unlock_irq(&priv->lock);