Commit 9217b27b authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Roland Dreier

IB/ipoib: Fix flush/start xmit race (from code review)

Prevent flush task from freeing the ipoib_neigh pointer, while
ipoib_start_xmit() is accessing the ipoib_neigh through the pointer it
has loaded from the skb's hardware address.
Signed-off-by: default avatarMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 9fd558f4
...@@ -336,7 +336,8 @@ void ipoib_flush_paths(struct net_device *dev) ...@@ -336,7 +336,8 @@ void ipoib_flush_paths(struct net_device *dev)
struct ipoib_path *path, *tp; struct ipoib_path *path, *tp;
LIST_HEAD(remove_list); LIST_HEAD(remove_list);
spin_lock_irq(&priv->lock); spin_lock_irq(&priv->tx_lock);
spin_lock(&priv->lock);
list_splice(&priv->path_list, &remove_list); list_splice(&priv->path_list, &remove_list);
INIT_LIST_HEAD(&priv->path_list); INIT_LIST_HEAD(&priv->path_list);
...@@ -347,12 +348,15 @@ void ipoib_flush_paths(struct net_device *dev) ...@@ -347,12 +348,15 @@ void ipoib_flush_paths(struct net_device *dev)
list_for_each_entry_safe(path, tp, &remove_list, list) { list_for_each_entry_safe(path, tp, &remove_list, list) {
if (path->query) if (path->query)
ib_sa_cancel_query(path->query_id, path->query); ib_sa_cancel_query(path->query_id, path->query);
spin_unlock_irq(&priv->lock); spin_unlock(&priv->lock);
spin_unlock_irq(&priv->tx_lock);
wait_for_completion(&path->done); wait_for_completion(&path->done);
path_free(dev, path); path_free(dev, path);
spin_lock_irq(&priv->lock); spin_lock_irq(&priv->tx_lock);
spin_lock(&priv->lock);
} }
spin_unlock_irq(&priv->lock); spin_unlock(&priv->lock);
spin_unlock_irq(&priv->tx_lock);
} }
static void path_rec_completion(int status, static void path_rec_completion(int status,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment