RDMA/iwcm: Don't touch cm_id after deref in rem_ref
RDMA/iwcm: Don't touch cm_id after deref in rem_ref

rem_ref() calls iwcm_deref_id(), which will wake up any blockers on
cm_id_priv->destroy_comp if the refcnt hits 0.  That will unblock
someone in iw_destroy_cm_id() which will free the cmid.  If that
happens before rem_ref() calls test_bit(IWCM_F_CALLBACK_DESTROY,
&cm_id_priv->flags), then the test_bit() will touch freed memory.

The fix is to read the bit first, then deref.  We should never be in
iw_destroy_cm_id() with IWCM_F_CALLBACK_DESTROY set, and there is a
BUG_ON() to make sure of that.

Signed-off-by: Steve Wise <6f43c86433b33e5fe92b209bedebd0f6dba5b49c@opengridcomputing.com>
Signed-off-by: Roland Dreier <0d270388f2f92757a5de0f4bd891d3b392c44c4f@purestorage.com>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs