Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa16ebed authored by Shlomo Pongratz's avatar Shlomo Pongratz Committed by Roland Dreier
Browse files

IB/ipoib: Add missing locking when CM object is deleted 



Commit b63b70d8 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_cm_destroy_tx() a CM
object is moved between lists without any supported locking.  Under a
stress test, this eventually leads to list corruption and a crash.

Previously when this routine was called, callers were taking the
device priv lock.  Currently this function is called from the RCU
callback associated with neighbour deletion.  Fix the race by taking
the same lock we used to before.

Signed-off-by: default avatarShlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 0d7614f0

drivers/infiniband/ulp/ipoib/ipoib_cm.c

+3 −0
Original line number Diff line number Diff line
@@ -1271,12 +1271,15 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path 
void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)

{

	struct ipoib_dev_priv *priv = netdev_priv(tx->dev);

	unsigned long flags;

	if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {

		spin_lock_irqsave(&priv->lock, flags);

		list_move(&tx->list, &priv->cm.reap_list);

		queue_work(ipoib_workqueue, &priv->cm.reap_task);

		ipoib_dbg(priv, "Reap connection for gid %pI6\n",

			  tx->neigh->daddr + 4);

		tx->neigh = NULL;

		spin_unlock_irqrestore(&priv->lock, flags);

	}

}