RDMA/cma: Fix synchronization with device removal in cma_iw_handler

The cma_iw_handler needs to validate the state of the rdma_cm_id before
processing a new connection request to ensure that a device removal is
not already being processed for the same rdma_cm_id.  Without the state
check, the user can receive simultaneous callbacks for the same cm_id, or
a callback after they've destroyed the cm_id.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d026764c7e9c..cfd57b4abd03 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1183,9 +1183,10 @@ static int cma_iw_handler(struct iw_cm_id *iw_id, struct iw_cm_event *iw_event)
         struct sockaddr_in *sin;
         int ret = 0;
 
-        memset(&event, 0, sizeof event);
-        atomic_inc(&id_priv->dev_remove);
+        if (cma_disable_remove(id_priv, CMA_CONNECT))
+                return 0;
 
+        memset(&event, 0, sizeof event);
         switch (iw_event->event) {
         case IW_CM_EVENT_CLOSE:
                 event.event = RDMA_CM_EVENT_DISCONNECTED;