diff mbox

[rdma-next,9/9] IB/ipoib: Change list_del to list_del_init in the tx object

Message ID 20161227133911.14340-10-leon@kernel.org (mailing list archive)
State Superseded
Headers show

Commit Message

Leon Romanovsky Dec. 27, 2016, 1:39 p.m. UTC
From: Feras Daoud <ferasda@mellanox.com>

Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
belong to different work queues, they can run in parallel.
In this case if ipoib_cm_tx_reap calls list_del and release the
lock, ipoib_cm_tx_start may acquire it and call list_del_init
on the already deleted object.
Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Reviewed-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
---
 drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Yuval Shaia Dec. 28, 2016, 1:06 p.m. UTC | #1
On Tue, Dec 27, 2016 at 03:39:11PM +0200, Leon Romanovsky wrote:
> From: Feras Daoud <ferasda@mellanox.com>
> 
> Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
> belong to different work queues, they can run in parallel.
> In this case if ipoib_cm_tx_reap calls list_del and release the
> lock, ipoib_cm_tx_start may acquire it and call list_del_init
> on the already deleted object.
> Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.
> 
> Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
> Signed-off-by: Feras Daoud <ferasda@mellanox.com>
> Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
> Reviewed-by: Alex Vesker <valex@mellanox.com>
> Signed-off-by: Leon Romanovsky <leon@kernel.org>
> ---
>  drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> index b6444b2..cc08379 100644
> --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> @@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
>  
>  	while (!list_empty(&priv->cm.reap_list)) {
>  		p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
> -		list_del(&p->list);
> +		list_del_init(&p->list);
>  		spin_unlock_irqrestore(&priv->lock, flags);
>  		netif_tx_unlock_bh(dev);
>  		ipoib_cm_tx_destroy(p);
> -- 

Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>

> 2.10.2
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index b6444b2..cc08379 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1392,7 +1392,7 @@  static void ipoib_cm_tx_reap(struct work_struct *work)
 
 	while (!list_empty(&priv->cm.reap_list)) {
 		p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-		list_del(&p->list);
+		list_del_init(&p->list);
 		spin_unlock_irqrestore(&priv->lock, flags);
 		netif_tx_unlock_bh(dev);
 		ipoib_cm_tx_destroy(p);