| Message ID | 20161227133911.14340-10-leon@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
On Tue, Dec 27, 2016 at 03:39:11PM +0200, Leon Romanovsky wrote: > From: Feras Daoud <ferasda@mellanox.com> > > Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function > belong to different work queues, they can run in parallel. > In this case if ipoib_cm_tx_reap calls list_del and release the > lock, ipoib_cm_tx_start may acquire it and call list_del_init > on the already deleted object. > Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem. > > Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support") > Signed-off-by: Feras Daoud <ferasda@mellanox.com> > Signed-off-by: Erez Shitrit <erezsh@mellanox.com> > Reviewed-by: Alex Vesker <valex@mellanox.com> > Signed-off-by: Leon Romanovsky <leon@kernel.org> > --- > drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c > index b6444b2..cc08379 100644 > --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c > +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c > @@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work) > > while (!list_empty(&priv->cm.reap_list)) { > p = list_entry(priv->cm.reap_list.next, typeof(*p), list); > - list_del(&p->list); > + list_del_init(&p->list); > spin_unlock_irqrestore(&priv->lock, flags); > netif_tx_unlock_bh(dev); > ipoib_cm_tx_destroy(p); > -- Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> > 2.10.2 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c index b6444b2..cc08379 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c @@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work) while (!list_empty(&priv->cm.reap_list)) { p = list_entry(priv->cm.reap_list.next, typeof(*p), list); - list_del(&p->list); + list_del_init(&p->list); spin_unlock_irqrestore(&priv->lock, flags); netif_tx_unlock_bh(dev); ipoib_cm_tx_destroy(p);