Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a509372 authored by Niels Dossche's avatar Niels Dossche Committed by Greg Kroah-Hartman
Browse files

IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition 

[ Upstream commit 4d809f69695d4e7d1378b3a072fa9aef23123018 ]

The documentation of the function rvt_error_qp says both r_lock and s_lock
need to be held when calling that function.  It also asserts using lockdep
that both of those locks are held.  However, the commit I referenced in
Fixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no
longer covered by r_lock.  This results in the lockdep assertion failing
and also possibly in a race condition.

Fixes: d757c60e ("IB/rdmavt: Fix concurrency panics in QP post_send and modify to error")
Link: https://lore.kernel.org/r/20220228165330.41546-1-dossche.niels@gmail.com


Signed-off-by: default avatarNiels Dossche <dossche.niels@gmail.com>
Acked-by: default avatarDennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 1ef586a8

drivers/infiniband/sw/rdmavt/qp.c

+5 −1
Original line number Diff line number Diff line
@@ -3227,7 +3227,11 @@ void rvt_ruc_loopback(struct rvt_qp *sqp) 
	spin_lock_irqsave(&sqp->s_lock, flags);

	rvt_send_complete(sqp, wqe, send_status);

	if (sqp->ibqp.qp_type == IB_QPT_RC) {

		int lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR);

		int lastwqe;



		spin_lock(&sqp->r_lock);

		lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR);

		spin_unlock(&sqp->r_lock);



		sqp->s_flags &= ~RVT_S_BUSY;

		spin_unlock_irqrestore(&sqp->s_lock, flags);