RDMA/cxgb4: Serialize calls to CQ's comp_handler

Commit 01e7da6ba53c ("RDMA/cxgb4: Make sure flush CQ entries are
collected on connection close") introduced a potential problem where a
CQ's comp_handler can get called simultaneously from different places
in the iw_cxgb4 driver.  This does not comply with
Documentation/infiniband/core_locking.txt, which states that at a
given point of time, there should be only one callback per CQ should
be active.

This problem was reported by Parav Pandit <Parav.Pandit@Emulex.Com>.
Based on discussion between Parav Pandit and Steve Wise, this patch
fixes the above problem by serializing the calls to a CQ's
comp_handler using a spin_lock.

Reported-by: Parav Pandit <Parav.Pandit@Emulex.Com>
Signed-off-by: Kumar Sanghvi <kumaras@chelsio.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

1 files changed, 13 insertions, 2 deletions

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 892fa7c6d310..62c7262a9eb3 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -941,8 +941,11 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
         flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
         spin_unlock(&qhp->lock);
         spin_unlock_irqrestore(&rchp->lock, flag);
-        if (flushed)
+        if (flushed) {
+                spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                 (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+                spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
+        }
 
         /* locking hierarchy: cq lock first, then qp lock. */
         spin_lock_irqsave(&schp->lock, flag);
@@ -952,13 +955,17 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
         flushed = c4iw_flush_sq(&qhp->wq, &schp->cq, count);
         spin_unlock(&qhp->lock);
         spin_unlock_irqrestore(&schp->lock, flag);
-        if (flushed)
+        if (flushed) {
+                spin_lock_irqsave(&schp->comp_handler_lock, flag);
                 (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
+                spin_unlock_irqrestore(&schp->comp_handler_lock, flag);
+        }
 }
 
 static void flush_qp(struct c4iw_qp *qhp)
 {
         struct c4iw_cq *rchp, *schp;
+        unsigned long flag;
 
         rchp = get_chp(qhp->rhp, qhp->attr.rcq);
         schp = get_chp(qhp->rhp, qhp->attr.scq);
@@ -966,11 +973,15 @@ static void flush_qp(struct c4iw_qp *qhp)
         if (qhp->ibqp.uobject) {
                 t4_set_wq_in_error(&qhp->wq);
                 t4_set_cq_in_error(&rchp->cq);
+                spin_lock_irqsave(&rchp->comp_handler_lock, flag);
                 (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+                spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
                 if (schp != rchp) {
                         t4_set_cq_in_error(&schp->cq);
+                        spin_lock_irqsave(&schp->comp_handler_lock, flag);
                         (*schp->ibcq.comp_handler)(&schp->ibcq,
                                         schp->ibcq.cq_context);
+                        spin_unlock_irqrestore(&schp->comp_handler_lock, flag);
                 }
                 return;
         }