mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-29 23:53:32 +00:00
IPoIB: Avoid using stale last_send counter when reaping AHs
The comparisons of priv->tx_tail to ah->last_send in ipoib_free_ah() and ipoib_post_receive() are slightly unsafe, because priv->tx_lock is not held and hence a stale value of ah->last_send might be used, which would lead to freeing an AH before the driver was really done with it. The simple way to fix this is to the optimization of early free from ipoib_free_ah() and unconditionally queue AHs for reaping, and then take priv->tx_lock in __ipoib_reap_ah(). Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
9874e74655
commit
31c02e2157
1 changed files with 9 additions and 18 deletions
|
@ -84,15 +84,9 @@ void ipoib_free_ah(struct kref *kref)
|
|||
|
||||
unsigned long flags;
|
||||
|
||||
if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
|
||||
ipoib_dbg(priv, "Freeing ah %p\n", ah->ah);
|
||||
ib_destroy_ah(ah->ah);
|
||||
kfree(ah);
|
||||
} else {
|
||||
spin_lock_irqsave(&priv->lock, flags);
|
||||
list_add_tail(&ah->list, &priv->dead_ahs);
|
||||
spin_unlock_irqrestore(&priv->lock, flags);
|
||||
}
|
||||
spin_lock_irqsave(&priv->lock, flags);
|
||||
list_add_tail(&ah->list, &priv->dead_ahs);
|
||||
spin_unlock_irqrestore(&priv->lock, flags);
|
||||
}
|
||||
|
||||
static int ipoib_ib_post_receive(struct net_device *dev, int id)
|
||||
|
@ -377,19 +371,16 @@ static void __ipoib_reap_ah(struct net_device *dev)
|
|||
struct ipoib_ah *ah, *tah;
|
||||
LIST_HEAD(remove_list);
|
||||
|
||||
spin_lock_irq(&priv->lock);
|
||||
spin_lock_irq(&priv->tx_lock);
|
||||
spin_lock(&priv->lock);
|
||||
list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
|
||||
if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
|
||||
list_del(&ah->list);
|
||||
list_add_tail(&ah->list, &remove_list);
|
||||
ib_destroy_ah(ah->ah);
|
||||
kfree(ah);
|
||||
}
|
||||
spin_unlock_irq(&priv->lock);
|
||||
|
||||
list_for_each_entry_safe(ah, tah, &remove_list, list) {
|
||||
ipoib_dbg(priv, "Reaping ah %p\n", ah->ah);
|
||||
ib_destroy_ah(ah->ah);
|
||||
kfree(ah);
|
||||
}
|
||||
spin_unlock(&priv->lock);
|
||||
spin_unlock_irq(&priv->tx_lock);
|
||||
}
|
||||
|
||||
void ipoib_reap_ah(void *dev_ptr)
|
||||
|
|
Loading…
Reference in a new issue