Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a39c52ab authored by Erez Shitrit's avatar Erez Shitrit Committed by Roland Dreier
Browse files

IPoIB: Add path query flushing in ipoib_ib_dev_cleanup 



The path_rec_completion() callback may be invoked asynchronously even
at the middle of "driver uninit" process.  This can lead to scheduling
a task that tries to touch members of the priv object that are no
longer valid.  For example the function cm_create_tx_qp can attempt to
create qp with no valid priv->pd object.

The following crash is one of the results:
RIP: 0010:[<ffffffffa021bb47>]  [<ffffffffa021bb47>] ipoib_cm_create_tx_qp+0x57/0x90 [ib_ipoib]
Process ipoib (pid: 5916, threadinfo ffff8803786e4000, task ffff8804150e1500)
Stack:
Call Trace:
[<ffffffff81309ef0>] ? get_random_bytes+0x20/0x30
[<ffffffffa021be2a>] ipoib_cm_tx_init+0xca/0x340 [ib_ipoib]
[<ffffffffa021f765>] ipoib_cm_tx_start+0x215/0x3f0 [ib_ipoib]
[<ffffffffa021f550>] ? ipoib_cm_tx_start+0x0/0x3f0 [ib_ipoib]
[<ffffffff8108b2b0>] worker_thread+0x170/0x2a0
[<ffffffff81090bf0>] ? autoremove_wake_function+0x0/0x40
[<ffffffff8108b140>] ? worker_thread+0x0/0x2a0
[<ffffffff81090886>] kthread+0x96/0xa0
[<ffffffff8100c14a>] child_rip+0xa/0x20
[<ffffffff810907f0>] ? kthread+0x0/0xa0
[<ffffffff8100c140>] ? child_rip+0x0/0x20

Fix that by flushing all pending path queries at this point.

Signed-off-by: default avatarAlex Markuze <markuze@mellanox.com>
Signed-off-by: default avatarErez Shitrit <erezsh@mellanox.com>
Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent a9c8ba58

drivers/infiniband/ulp/ipoib/ipoib_ib.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -1082,6 +1082,11 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) 
	struct ipoib_dev_priv *priv = netdev_priv(dev);

	struct ipoib_dev_priv *priv = netdev_priv(dev);





	ipoib_dbg(priv, "cleaning up ib_dev\n");

	ipoib_dbg(priv, "cleaning up ib_dev\n");

	/*

	 * We must make sure there are no more (path) completions

	 * that may wish to touch priv fields that are no longer valid

	 */

	ipoib_flush_paths(dev);





	ipoib_mcast_stop_thread(dev, 1);

	ipoib_mcast_stop_thread(dev, 1);

	ipoib_mcast_dev_flush(dev);

	ipoib_mcast_dev_flush(dev);