aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoland Dreier <rolandd@cisco.com>2008-09-25 18:28:08 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-09-25 19:37:03 -0400
commit6ef190cc92e33565accff6a320f0e7d90480bfe7 (patch)
treeb898c20fa9baba3a10ba03b5a64911bd3c8416f1
parentefba91bd9066890ae93270eb3d0e55de43368f0b (diff)
IPoIB: Fix crash when path record fails after path flush
Commit ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM change events") changed how paths are flushed on an SM event. This change introduces a problem if the path record query triggered by fails, causing path->ah to become NULL. A later successful path query will then trigger WARN_ON() in path_rec_completion(), and crash because path->ah has already been freed, so the ipoib_put_ah() inside the lock in path_rec_completion() may actually drop the last reference (contrary to the comment that claims this is safe). Fix this by updating path->ah and freeing old_ah only when the path record query is successful. This prevents the neighbour AH and that path AH from getting out of sync. This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1194> Reported-by: Rabah Salem <ravah@mellanox.com> Debugged-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/infiniband/ulp/ipoib/ipoib_main.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1b1df5cc4113..e9ca3cb57d52 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,7 +404,7 @@ static void path_rec_completion(int status,
404 struct net_device *dev = path->dev; 404 struct net_device *dev = path->dev;
405 struct ipoib_dev_priv *priv = netdev_priv(dev); 405 struct ipoib_dev_priv *priv = netdev_priv(dev);
406 struct ipoib_ah *ah = NULL; 406 struct ipoib_ah *ah = NULL;
407 struct ipoib_ah *old_ah; 407 struct ipoib_ah *old_ah = NULL;
408 struct ipoib_neigh *neigh, *tn; 408 struct ipoib_neigh *neigh, *tn;
409 struct sk_buff_head skqueue; 409 struct sk_buff_head skqueue;
410 struct sk_buff *skb; 410 struct sk_buff *skb;
@@ -428,12 +428,12 @@ static void path_rec_completion(int status,
428 428
429 spin_lock_irqsave(&priv->lock, flags); 429 spin_lock_irqsave(&priv->lock, flags);
430 430
431 old_ah = path->ah;
432 path->ah = ah;
433
434 if (ah) { 431 if (ah) {
435 path->pathrec = *pathrec; 432 path->pathrec = *pathrec;
436 433
434 old_ah = path->ah;
435 path->ah = ah;
436
437 ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n", 437 ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n",
438 ah, be16_to_cpu(pathrec->dlid), pathrec->sl); 438 ah, be16_to_cpu(pathrec->dlid), pathrec->sl);
439 439