Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84ba284c authored by Sean Hefty's avatar Sean Hefty Committed by Roland Dreier
Browse files

IB/cm: Flush workqueue when removing device 



When a CM MAD is received, it is queued to a CM workqueue for
processing.  The queued work item references the port and device on
which the MAD was received.  If that device is removed from the system
before the work item can execute, the work item will reference freed
memory.

To fix this, flush the workqueue after unregistering to receive MAD,
and before the device is be freed.

Signed-off-by: default avatarSean Hefty <sean.hefty@intel.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 18b8c8f1

drivers/infiniband/core/cm.c

+2 −1
Original line number Diff line number Diff line
@@ -3759,6 +3759,7 @@ static void cm_remove_one(struct ib_device *device) 
		port = cm_dev->port[i-1];

		ib_modify_port(device, port->port_num, 0, &port_modify);

		ib_unregister_mad_agent(port->mad_agent);

		flush_workqueue(cm.wq);

		cm_remove_port_fs(port);

	}

	kobject_put(&cm_dev->dev_obj);
@@ -3813,6 +3814,7 @@ static void __exit ib_cm_cleanup(void) 
		cancel_delayed_work(&timewait_info->work.work);

	spin_unlock_irq(&cm.lock);



	ib_unregister_client(&cm_client);

	destroy_workqueue(cm.wq);



	list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
@@ -3820,7 +3822,6 @@ static void __exit ib_cm_cleanup(void) 
		kfree(timewait_info);

	}



	ib_unregister_client(&cm_client);

	class_unregister(&cm_class);

	idr_destroy(&cm.local_id_table);

}