[infiniband] Avoid multiple calls to ib_cmrc_shutdown()

When a CMRC connection is closed, the deferred shutdown process calls
ib_destroy_qp().  This will cause the receive work queue entries to
complete in error (since they are being cancelled), which will in turn
reschedule the deferred shutdown process.  This eventually leads to
ib_destroy_conn() being called on a connection that has already been
freed.

Fix by explicitly cancelling any pending shutdown process after the
shutdown process has completed.

Ironically, this almost exactly reverts commit 019d4c1 ("[infiniband]
Use a one-shot process for CMRC shutdown"); prior to the introduction
of one-shot processes the only way to achieve a one-shot process was
for the process to cancel itself.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/net/infiniband/ib_cmrc.c b/src/net/infiniband/ib_cmrc.c
index 1cc0fcfe..513c6f43 100644
--- a/src/net/infiniband/ib_cmrc.c
+++ b/src/net/infiniband/ib_cmrc.c
@@ -117,6 +117,9 @@ static void ib_cmrc_shutdown ( struct ib_cmrc_connection *cmrc ) {
 	ib_destroy_cq ( cmrc->ibdev, cmrc->cq );
 	ib_close ( cmrc->ibdev );
 
+	/* Cancel any pending shutdown */
+	process_del ( &cmrc->shutdown );
+
 	/* Drop the remaining reference */
 	ref_put ( &cmrc->refcnt );
 }