ib_cancel_mad(cm_id_priv->av.port->mad_agent, (unsigned long) cm_id_priv->msg); 
ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg); 
void ib_destroy_cm_id(struct ib_cm_id *cm_id){	struct cm_id_private *cm_id_priv;	struct cm_work *work;	unsigned long flags;	cm_id_priv = container_of(cm_id, struct cm_id_private, id);retest:	spin_lock_irqsave(&cm_id_priv->lock, flags);	switch (cm_id->state) {	case IB_CM_LISTEN:		cm_id->state = IB_CM_IDLE;		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		spin_lock_irqsave(&cm.lock, flags);		rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);		spin_unlock_irqrestore(&cm.lock, flags);		break;	case IB_CM_SIDR_REQ_SENT:		cm_id->state = IB_CM_IDLE;		ib_cancel_mad(cm_id_priv->av.port->mad_agent,			      (unsigned long) cm_id_priv->msg);		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		break;	case IB_CM_SIDR_REQ_RCVD:		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);		break;	case IB_CM_REQ_SENT:	case IB_CM_MRA_REQ_RCVD:	case IB_CM_REP_SENT:	case IB_CM_MRA_REP_RCVD:		ib_cancel_mad(cm_id_priv->av.port->mad_agent,			      (unsigned long) cm_id_priv->msg);		/* Fall through */	case IB_CM_REQ_RCVD:	case IB_CM_MRA_REQ_SENT:	case IB_CM_REP_RCVD:	case IB_CM_MRA_REP_SENT:		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,			       &cm_id_priv->av.port->cm_dev->ca_guid,			       sizeof cm_id_priv->av.port->cm_dev->ca_guid,			       NULL, 0);		break;	case IB_CM_ESTABLISHED:		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		ib_send_cm_dreq(cm_id, NULL, 0);		goto retest;	case IB_CM_DREQ_SENT:		ib_cancel_mad(cm_id_priv->av.port->mad_agent,			      (unsigned long) cm_id_priv->msg);		cm_enter_timewait(cm_id_priv);		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		break;	case IB_CM_DREQ_RCVD:		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		ib_send_cm_drep(cm_id, NULL, 0);		break;	default:		spin_unlock_irqrestore(&cm_id_priv->lock, flags);		break;	}	cm_free_id(cm_id->local_id);	atomic_dec(&cm_id_priv->refcount);	wait_event(cm_id_priv->wait, !atomic_read(&cm_id_priv->refcount));	while ((work = cm_dequeue_work(cm_id_priv)) != NULL)		cm_free_work(work);	if (cm_id_priv->private_data && cm_id_priv->private_data_len)		kfree(cm_id_priv->private_data);	kfree(cm_id_priv);}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/34816ad98efe4d47ffd858a0345321f9d85d9420/cm.c/buggy/drivers/infiniband/core/cm.c