Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a30bb96c authored by Eli Cohen's avatar Eli Cohen Committed by Roland Dreier
Browse files

IPoIB: Close race in ipoib_flush_paths() 



ib_sa_cancel_query() must be called with priv->lock held since
a completion might arrive and set path->query to NULL.

Signed-off-by: default avatarEli Cohen <eli@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent abf45dbb

drivers/infiniband/ulp/ipoib/ipoib_main.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -346,14 +346,15 @@ void ipoib_flush_paths(struct net_device *dev) 
	list_for_each_entry(path, &remove_list, list)

	list_for_each_entry(path, &remove_list, list)

		rb_erase(&path->rb_node, &priv->path_tree);

		rb_erase(&path->rb_node, &priv->path_tree);





	spin_unlock_irqrestore(&priv->lock, flags);



	list_for_each_entry_safe(path, tp, &remove_list, list) {

	list_for_each_entry_safe(path, tp, &remove_list, list) {

		if (path->query)

		if (path->query)

			ib_sa_cancel_query(path->query_id, path->query);

			ib_sa_cancel_query(path->query_id, path->query);

		spin_unlock_irqrestore(&priv->lock, flags);

		wait_for_completion(&path->done);

		wait_for_completion(&path->done);

		path_free(dev, path);

		path_free(dev, path);

		spin_lock_irqsave(&priv->lock, flags);

	}

	}

	spin_unlock_irqrestore(&priv->lock, flags);

}

}





static void path_rec_completion(int status,

static void path_rec_completion(int status,