diff options
author | Roland Dreier <rolandd@cisco.com> | 2008-09-25 18:28:08 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-09-25 19:37:03 -0400 |
commit | 6ef190cc92e33565accff6a320f0e7d90480bfe7 (patch) | |
tree | b898c20fa9baba3a10ba03b5a64911bd3c8416f1 | |
parent | efba91bd9066890ae93270eb3d0e55de43368f0b (diff) |
IPoIB: Fix crash when path record fails after path flush
Commit ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM
change events") changed how paths are flushed on an SM event. This
change introduces a problem if the path record query triggered by
fails, causing path->ah to become NULL. A later successful path query
will then trigger WARN_ON() in path_rec_completion(), and crash
because path->ah has already been freed, so the ipoib_put_ah() inside
the lock in path_rec_completion() may actually drop the last reference
(contrary to the comment that claims this is safe).
Fix this by updating path->ah and freeing old_ah only when the path
record query is successful. This prevents the neighbour AH and that
path AH from getting out of sync.
This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1194>
Reported-by: Rabah Salem <ravah@mellanox.com>
Debugged-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c index 1b1df5cc4113..e9ca3cb57d52 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c | |||
@@ -404,7 +404,7 @@ static void path_rec_completion(int status, | |||
404 | struct net_device *dev = path->dev; | 404 | struct net_device *dev = path->dev; |
405 | struct ipoib_dev_priv *priv = netdev_priv(dev); | 405 | struct ipoib_dev_priv *priv = netdev_priv(dev); |
406 | struct ipoib_ah *ah = NULL; | 406 | struct ipoib_ah *ah = NULL; |
407 | struct ipoib_ah *old_ah; | 407 | struct ipoib_ah *old_ah = NULL; |
408 | struct ipoib_neigh *neigh, *tn; | 408 | struct ipoib_neigh *neigh, *tn; |
409 | struct sk_buff_head skqueue; | 409 | struct sk_buff_head skqueue; |
410 | struct sk_buff *skb; | 410 | struct sk_buff *skb; |
@@ -428,12 +428,12 @@ static void path_rec_completion(int status, | |||
428 | 428 | ||
429 | spin_lock_irqsave(&priv->lock, flags); | 429 | spin_lock_irqsave(&priv->lock, flags); |
430 | 430 | ||
431 | old_ah = path->ah; | ||
432 | path->ah = ah; | ||
433 | |||
434 | if (ah) { | 431 | if (ah) { |
435 | path->pathrec = *pathrec; | 432 | path->pathrec = *pathrec; |
436 | 433 | ||
434 | old_ah = path->ah; | ||
435 | path->ah = ah; | ||
436 | |||
437 | ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n", | 437 | ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n", |
438 | ah, be16_to_cpu(pathrec->dlid), pathrec->sl); | 438 | ah, be16_to_cpu(pathrec->dlid), pathrec->sl); |
439 | 439 | ||