diff mbox series

[for-rc] IB/hfi1: Correctly move list in sc_disable()

Message ID 166610327042.674422.6146908799669288976.stgit@awfm-02.cornelisnetworks.com (mailing list archive)
State Accepted
Headers show
Series [for-rc] IB/hfi1: Correctly move list in sc_disable() | expand

Commit Message

Dennis Dalessandro Oct. 18, 2022, 2:27 p.m. UTC 
From: Dean Luick <dean.luick@cornelisnetworks.com>

Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with
sc_disable()") incorrectly tries to move a list from one list
head to another.  The result is a kernel crash.

The crash is triggered when a link goes down and there are
waiters for a send to complete.  The following signature is
seen:

BUG: kernel NULL pointer dereference, address: 0000000000000030
[...]
Call Trace:
 <TASK>
 sc_disable+0x1ba/0x240 [hfi1]
 pio_freeze+0x3d/0x60 [hfi1]
 handle_freeze+0x27/0x1b0 [hfi1]
 process_one_work+0x1b0/0x380
 ? process_one_work+0x380/0x380
 worker_thread+0x30/0x360
 ? process_one_work+0x380/0x380
 kthread+0xd7/0x100
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x1f/0x30
 </TASK>

The fix is to use the correct call to move the list.

Fixes: 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()")
Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
---
 drivers/infiniband/hw/hfi1/pio.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Leon Romanovsky Oct. 19, 2022, 7:06 a.m. UTC | #1 
On Tue, 18 Oct 2022 10:27:50 -0400, Dennis Dalessandro wrote:
> From: Dean Luick <dean.luick@cornelisnetworks.com>
> 
> Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with
> sc_disable()") incorrectly tries to move a list from one list
> head to another.  The result is a kernel crash.
> 
> The crash is triggered when a link goes down and there are
> waiters for a send to complete.  The following signature is
> seen:
> 
> [...]

Applied, thanks!

[1/1] IB/hfi1: Correctly move list in sc_disable()
      https://git.kernel.org/rdma/rdma/c/ffad65329ba89c

Best regards,
diff mbox series

Patch

diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index 3d42bd2b36bd..51ae58c02b15 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -913,8 +913,7 @@  void sc_disable(struct send_context *sc)
 	spin_unlock(&sc->release_lock);
 
 	write_seqlock(&sc->waitlock);
-	if (!list_empty(&sc->piowait))
-		list_move(&sc->piowait, &wake_list);
+	list_splice_init(&sc->piowait, &wake_list);
 	write_sequnlock(&sc->waitlock);
 	while (!list_empty(&wake_list)) {
 		struct iowait *wait;