aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/ulp/ipoib/ipoib_main.c
diff options
context:
space:
mode:
authorEli Cohen <eli@mellanox.co.il>2006-04-05 08:59:34 -0400
committerRoland Dreier <rolandd@cisco.com>2006-04-10 12:43:59 -0400
commita30bb96c6f5aca6513e4dbd94962da03d14b20a9 (patch)
tree7314d0813071b9e1b808422c96e868c26e14245a /drivers/infiniband/ulp/ipoib/ipoib_main.c
parentabf45dbb5b256dab439ca3b6b71191ecfddf9cb6 (diff)
IPoIB: Close race in ipoib_flush_paths()
ib_sa_cancel_query() must be called with priv->lock held since a completion might arrive and set path->query to NULL. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/ulp/ipoib/ipoib_main.c')
-rw-r--r--drivers/infiniband/ulp/ipoib/ipoib_main.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 5bf7e263454b..996c6e16a46d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -346,14 +346,15 @@ void ipoib_flush_paths(struct net_device *dev)
346 list_for_each_entry(path, &remove_list, list) 346 list_for_each_entry(path, &remove_list, list)
347 rb_erase(&path->rb_node, &priv->path_tree); 347 rb_erase(&path->rb_node, &priv->path_tree);
348 348
349 spin_unlock_irqrestore(&priv->lock, flags);
350
351 list_for_each_entry_safe(path, tp, &remove_list, list) { 349 list_for_each_entry_safe(path, tp, &remove_list, list) {
352 if (path->query) 350 if (path->query)
353 ib_sa_cancel_query(path->query_id, path->query); 351 ib_sa_cancel_query(path->query_id, path->query);
352 spin_unlock_irqrestore(&priv->lock, flags);
354 wait_for_completion(&path->done); 353 wait_for_completion(&path->done);
355 path_free(dev, path); 354 path_free(dev, path);
355 spin_lock_irqsave(&priv->lock, flags);
356 } 356 }
357 spin_unlock_irqrestore(&priv->lock, flags);
357} 358}
358 359
359static void path_rec_completion(int status, 360static void path_rec_completion(int status,