From patchwork Wed Dec 20 17:51:40 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bryan Tan X-Patchwork-Id: 10126165 X-Patchwork-Delegate: jgg@ziepe.ca Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5845760390 for ; Wed, 20 Dec 2017 17:52:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 475D2290E9 for ; Wed, 20 Dec 2017 17:52:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3C48929115; Wed, 20 Dec 2017 17:52:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 88311290E9 for ; Wed, 20 Dec 2017 17:52:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755453AbdLTRv7 (ORCPT ); Wed, 20 Dec 2017 12:51:59 -0500 Received: from mail-dm3nam03on0073.outbound.protection.outlook.com ([104.47.41.73]:39034 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755397AbdLTRv6 (ORCPT ); Wed, 20 Dec 2017 12:51:58 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onevmw.onmicrosoft.com; s=selector1-vmware-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=AsatxzDjhF/UWFIrEf8aPe3ROoW5SN0FrwFuWPQ0ebQ=; b=cKFENOlAd8OxAvV/EFn4co/5V7toLiIKs8bGIaV8eVKeBSawnWviFQQ7Go8S0AJ8veTHbd/B9vk2ygN39RsWKEanzAOt/lbrjk9e+5FeACesr69aBSxRRGP+qB6h6CjDnAs2Gbyepvq7EUPmi5oyNe2SVmXNPNzD0g9oL9CbZYg= Received: from bryantan-devbox.prom.eng.vmware.com.prom.eng.vmware.com (208.91.1.34) by SN2PR05MB2784.namprd05.prod.outlook.com (2603:10b6:804:16::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.2; Wed, 20 Dec 2017 17:51:55 +0000 Date: Wed, 20 Dec 2017 09:51:40 -0800 From: Bryan Tan To: linux-rdma@vger.kernel.org Subject: [PATCH v2 for-rc 4/4] RDMA/vmw_pvrdma: Avoid use after free due to QP/CQ/SRQ destroy Message-ID: <20171220175126.GA23572@bryantan-devbox.prom.eng.vmware.com.prom.eng.vmware.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20171220174748.GA18149@bryantan-devbox.prom.eng.vmware.com.prom.eng.vmware.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Originating-IP: [208.91.1.34] X-ClientProxiedBy: DB6PR0202CA0018.eurprd02.prod.outlook.com (2603:10a6:4:29::28) To SN2PR05MB2784.namprd05.prod.outlook.com (2603:10b6:804:16::13) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c5302387-8dc8-4cae-1986-08d547d25c9c X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307)(7153060); SRVR:SN2PR05MB2784; X-Microsoft-Exchange-Diagnostics: 1; SN2PR05MB2784; 3:JpWhp0cYNwUDyzzk4mRzy4jS4P/Dn0TuylrsQxDz9/h7mhPXe6nsi/fSJsx4dToTwcR/WYuqqLW9NPsrS/5Kxa9/ix/V7o2tZAHgZxEwphg1iRQ4BdwXReZf/ZYSfG7uNsP2PI+xEtL4YyJI2sgGRZzeuJz2HS3rGUtSKY0PRyd1W1paJTCVlXCoYhbZEmXhUNJU+xTvktEIAg/Oro33MqqzQzYBMHJH9wLRujUFnqRRvNcYmRB6j2oSC1tJD3El; 25:HP/pONyfEPrVGFz/t9uJcN+fiAm86w06CLExjs+odCKTvcssDLqOzo26gwV97mSv6WJecTfOPqf0wrIntTzW1pf1wY0ervqasRNKULNI8nTefj9olXQG41NZJONO1BHhEMfszXcX66dFTFMduHom84a4icB4iUxS4TZOSqNfGE5SB6GO/KteA86bEt65vzby9cLSiOl53GJx1qBx2OhE1xLPG6HTQ9z3uw5oqR4gLhTuDJihJdUt9esKVcwWThmjkFN1rrtELYyEMXvNdd1PLTA18XVodPNYk06UoZjZubJDjUjCdTw/vzyuPQBpzF8v5ds8/TBZS9e8KMsBWtddUg==; 31:8Uti6BtIsH7gZ98H40mn7NWU0RXFL4Ls7s6c2pUtd4mo13g9SSBV/vMLSLbsktwKwMHat9K+rgGMKZb3QAWwX+Kr2yVnIuOCUO4VD76ksA1zwZoZaeZbYRxNJVHoXvoUUkNzdNiBzm6KxGzF4ovMfkpvoShu5X5TieGvjEZnKaFHcQXqmDKvxIdTQLSzDH5mD72nVkaaGlw7IB793GN3yAmKHjxehQbt6XeqE2brv/o= X-MS-TrafficTypeDiagnostic: SN2PR05MB2784: X-Microsoft-Exchange-Diagnostics: 1; SN2PR05MB2784; 20:BLRsTq7SaPUcb6yrZ4+h1nG03ZcmbNCQmgLpn1yhD6nbzHPFIbe654ZqhgN4LiMgCTs1YJpShQ49dII3/eekb/EOJzJHFYPSfs0bsfbLLzuYgw5HeEDRuE5V3x7/qebiWD0FuM+04m+4Tg7ax9c75N14N1yx59T7wEqQ+HM8BNxbwg2+2ISJebk7jt3cGBMPBygyoEYMHzWDZkqH2Onb4mInmYsdpIhHJ+fqj44P1SCbIt8s6851Ec8kumxsmzQNtDwdU21R8ife577srOmG4dXXoKXGK6cvE0Yk0UcF5c4jbMaiYh616ha/lKn33w9YFflPXmYvzPsm5K+k1IVV7+RRVqri0TCF93rkiqI2XL5Z6P6HBXbCnCK9JxDlgZyTx+qVozxXt8vFt/RGtCeqHsY3cInevDshzPsIDJNktvtPJcfkt1di+FfQkWGXu/sfc6QLhYAaXvVviJxe8zw/yfTPCg0IDBKl7j8gXRsJohQjz5uZKTQ/XAt2RrfoMCde; 4:56NBq1do3wvTYWDebKKe0tZVSAv3hoeLa5G8lyKoDxn1SgNNjdgCXqimxAAW3I/57Tg7qWbHVNs6UglfoTHhlwa05MaeCwcRKoMtFVlp45O3TFk3kLCMmf7DnRmsPHbFSIn+N990bMyELaCZoMlb4g+oIi8OUbccheDSEIrtlfM4h1GP+qebw45HDFY1SiFKFDN2YkPABFkP1AUNE7NtYFZ4Yj8Gzet4fI/FcBjZ0zmeJMZpfBauh+pwH9nPn8IAvm4K7hTkpKOuXGFnFUxFELBJ6Jl8zT80DQ/EHXVe7TvJGFEkHBks7xVM0+biY6in X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(61668805478150); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040470)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3231023)(3002001)(6041268)(20161123562045)(20161123560045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(6072148)(201708071742011); SRVR:SN2PR05MB2784; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:SN2PR05MB2784; X-Forefront-PRVS: 0527DFA348 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(39380400002)(39860400002)(376002)(366004)(346002)(396003)(189003)(199004)(5660300001)(2351001)(8936002)(50466002)(16526018)(68736007)(6666003)(25786009)(2361001)(105586002)(2950100002)(6916009)(106356001)(2906002)(53936002)(66066001)(47776003)(575784001)(7736002)(478600001)(386003)(81156014)(52116002)(1076002)(55016002)(59450400001)(8676002)(305945005)(6116002)(33656002)(81166006)(7696005)(23726003)(97736004)(83506002)(58126008)(16586007)(316002)(86362001)(3846002)(18370500001); DIR:OUT; SFP:1101; SCL:1; SRVR:SN2PR05MB2784; H:bryantan-devbox.prom.eng.vmware.com.prom.eng.vmware.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: vmware.com does not designate permitted sender hosts) Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=bryantan@vmware.com; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; SN2PR05MB2784; 23:vd1ZviTfvz/wxWosPjH7HxH4iFW6Umjp37NJHVfFU?= =?us-ascii?Q?8DmOAv4/KvYo2bgew/fpgBZXNBYOvocb95lc7tBtXAy780hyvZ7vmr5LZpEI?= =?us-ascii?Q?7FjW6Y0aB8IKodgEKPQ5uybwRg729YTEsJ/5Ddc2FN9V9xXefj2OIdPVg1+n?= =?us-ascii?Q?gv/dUk02esjXcItDBaw/Iki0HdpMfqTg4hOhWBtq2MUYhvjHjlGTwEu8C3NN?= =?us-ascii?Q?8WtqgjX09N00XtBylksMazNdUK5k7NKYDIdoK1/EKZHZD5s7bf900By6dZ4Q?= =?us-ascii?Q?b6odk2gZ2ErZ/dEuTJ629TOBTkCNSwTcD4xRxYy8mlKZhh/3B7IWlWG5ETLb?= =?us-ascii?Q?Ex2SEJ/re1Dn2nVSyfIr/sJVmJoxfONg6/UH9E0VpG6kkS1F5VXmOa6yfxGY?= =?us-ascii?Q?dBsV6QWElau/n/4x/NkqAHkS8V0UXVmb9hrLAzxW3vJwICiHE+KI6LWf/2Dr?= =?us-ascii?Q?abLkcjSX4/UT7Qk/hnhE1sNZGNNNM4CyXobN0aMX7VunIjJ9eLzbCrFjoEh3?= =?us-ascii?Q?eVjb6sQd9UXBQ/hOAlPUvUNfjtMbQR8HghO00RZ9oIUbuQ1wyCNU4iHOICoP?= =?us-ascii?Q?1ewXnBtxQ2f7XWn46aOG3zWQKcnBesYD9G1NaanrK3QEreEmHXDWjv5yNto3?= =?us-ascii?Q?+YWmjxSBkk9b2xfjPZu/41270fvRhDUpX1B5p8MQBSfR7Wfvja7NDyarcVhs?= =?us-ascii?Q?7gisiZA3hBy5SUy85vo4SFDLIa+Dcebny2LqjnfO47sGCWd0lvloNZJyZi71?= =?us-ascii?Q?w5B/jEZR98AqPzAIbRV6BNNHhPzAmnMlMl+IV+OyAhb3vSX8YDl1uW2OTou6?= =?us-ascii?Q?5L5AEhyUW2hLZyD5erd4Bp42IQyQvgL3YeTqsYE37bc4GKKGPxKCfJjy5Nve?= =?us-ascii?Q?t02XTtFmKSe6lr7LadbA8D1Khj7mIiEXd8Myb7+Y5T3+ak7fLkfJfj+sJKog?= =?us-ascii?Q?M1ytMToJgpG9GeomMYcDmyzEpvYCTVpp4ldXOQVxJDw7G3GAocQjfzqaz3lj?= =?us-ascii?Q?cbXP2o4BFGu5X7vbUlmjGguZr/4DJZ8XoXHDeml0D+vLD6CRApvD/hdGozpm?= =?us-ascii?Q?WNYxokuii/wkrHWWD+DxTXqEdbvWKs9P0oyqalg40wB/QczpYhcSNPsXuOS6?= =?us-ascii?Q?cv6lT9q9vtOOfBbLDN4nOkzQpKI7S6c?= X-Microsoft-Exchange-Diagnostics: 1; SN2PR05MB2784; 6:9xx05amhT+xl8zrPKDqUjZIAceLeW4xD8AnGGh/XPPLwa/zPslKEn0CK4X9z5A/YNM8fCq5lCw0tKcbmRuq1xHTHxjVehdqZH65eK86h9aMN3rUxxrxGnOY+l7bcbbrmycl6sILnlgQ/I/UBeBCJK9c89CYJ9yMeY4S7FP+wRBqsD6fMr8vfW6N48hcDc9U5maP0OOHqUW547RCUFEMdVXCFBKVWZLCKl9LAzxgxKfTTrKHAMKfBrCUo3lFCDgouwxD54Ze5n8ulS0MT4q8v+CPAoWDKv9eYDd1cZMIGDXZiPS7SV3uhxw+01hURg7p468t5r+UAi316WFvAtnDhxzZb+YC3+uZmWbxhdiDDIbI=; 5:QSg0nzEgmc16Dp3jYReo4oD6qcwY0igdJ0IV3isLtwNaTolVc6I2pit4m+M+SoxmrFfsQw4fKRi4jAQf4t9Isyke3NIDXVU0OpDoT+6hh8awZwmxwL/TlASX5hM9mTTxNYiYyN6UfqgiFJOQmBr5FGi4ZBh7X+CzVr6TkDw2kT8=; 24:7InsgvnOKv1VlMOJgeyMlJ7hbgfjqWe7tkZ0k1LTxcr/1FRw3ZEA9uHsuDEYfIgYdWCIQyUA86CbbOfzhW1FYP+HnFx0bFjAmxZacAvF0QU=; 7:y9EXpcFN4MWLNJvKth+I4F/M5Vabi+vPUpttTIXufRsCwS9DRHG92czQE9Q/Pd5ZpS/SV61gzSABuP3DdWkAyJreqlcg3fZH7NY2zJZ60hvLwxdq7fdt5MVe2WjIY42FXL+5Olbgql8S7j7eppL4NU59W1aNdVFcRZocRNt1fuFBDTjSZjN5PhUedm71yLiy8eiISFe9Y61aWRhvRKvVXctFxwyEjYWFGLa0KVNr/GLxxXTMK6K4nzH9jnmNJFG1 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; SN2PR05MB2784; 20:jWenIO+WWuTSP+iB0uYb/nqiZLeTRr0T4i0tnPZwogGjJBDWV6g1484/Lb3B6KV3gFIkPEbOzr1fJAkNDa6MOCkiXMtP9tHjhHIEs21I5QzyoHZehNV8sAHUqvvWlkPnTXX0B55efTGK7Q9P8MkY8oipTuk04j81A9+FLjEBiWw= X-OriginatorOrg: vmware.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Dec 2017 17:51:55.6013 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c5302387-8dc8-4cae-1986-08d547d25c9c X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR05MB2784 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The use of wait queues in vmw_pvrdma for handling concurrent access to a resource leaves a possible use after free bug. Fix this by using completions instead, and also using atomic_dec_and_test to ensure complete() is called only once. Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") Signed-off-by: Bryan Tan --- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 6 +++--- drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c | 7 ++++--- drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 17 +++++++---------- drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 7 ++++--- drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c | 7 ++++--- 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h index 63bc2ef..4f7bd3b6 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h @@ -94,7 +94,7 @@ struct pvrdma_cq { u32 cq_handle; bool is_kernel; atomic_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_id_table { @@ -175,7 +175,7 @@ struct pvrdma_srq { u32 srq_handle; int npages; refcount_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_qp { @@ -197,7 +197,7 @@ struct pvrdma_qp { bool is_kernel; struct mutex mutex; /* QP state mutex. */ atomic_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_dev { diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c index 3562c0c..e529622 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c @@ -179,7 +179,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, pvrdma_page_dir_insert_umem(&cq->pdir, cq->umem, 0); atomic_set(&cq->refcnt, 1); - init_waitqueue_head(&cq->wait); + init_completion(&cq->free); spin_lock_init(&cq->cq_lock); memset(cmd, 0, sizeof(*cmd)); @@ -230,8 +230,9 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, static void pvrdma_free_cq(struct pvrdma_dev *dev, struct pvrdma_cq *cq) { - atomic_dec(&cq->refcnt); - wait_event(cq->wait, !atomic_read(&cq->refcnt)); + if (atomic_dec_and_test(&cq->refcnt)) + complete(&cq->free); + wait_for_completion(&cq->free); if (!cq->is_kernel) ib_umem_release(cq->umem); diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c index 1f4e187..e926818 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c @@ -346,9 +346,8 @@ static void pvrdma_qp_event(struct pvrdma_dev *dev, u32 qpn, int type) ibqp->event_handler(&e, ibqp->qp_context); } if (qp) { - atomic_dec(&qp->refcnt); - if (atomic_read(&qp->refcnt) == 0) - wake_up(&qp->wait); + if (atomic_dec_and_test(&qp->refcnt)) + complete(&qp->free); } } @@ -373,9 +372,8 @@ static void pvrdma_cq_event(struct pvrdma_dev *dev, u32 cqn, int type) ibcq->event_handler(&e, ibcq->cq_context); } if (cq) { - atomic_dec(&cq->refcnt); - if (atomic_read(&cq->refcnt) == 0) - wake_up(&cq->wait); + if (atomic_dec_and_test(&cq->refcnt)) + complete(&cq->free); } } @@ -404,7 +402,7 @@ static void pvrdma_srq_event(struct pvrdma_dev *dev, u32 srqn, int type) } if (srq) { if (refcount_dec_and_test(&srq->refcnt)) - wake_up(&srq->wait); + complete(&srq->free); } } @@ -539,9 +537,8 @@ static irqreturn_t pvrdma_intrx_handler(int irq, void *dev_id) if (cq && cq->ibcq.comp_handler) cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context); if (cq) { - atomic_dec(&cq->refcnt); - if (atomic_read(&cq->refcnt)) - wake_up(&cq->wait); + if (atomic_dec_and_test(&cq->refcnt)) + complete(&cq->free); } pvrdma_idx_ring_inc(&ring->cons_head, ring_slots); } diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c index dceebc6..4059308 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c @@ -246,7 +246,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd, spin_lock_init(&qp->rq.lock); mutex_init(&qp->mutex); atomic_set(&qp->refcnt, 1); - init_waitqueue_head(&qp->wait); + init_completion(&qp->free); qp->state = IB_QPS_RESET; @@ -428,8 +428,9 @@ static void pvrdma_free_qp(struct pvrdma_qp *qp) pvrdma_unlock_cqs(scq, rcq, &scq_flags, &rcq_flags); - atomic_dec(&qp->refcnt); - wait_event(qp->wait, !atomic_read(&qp->refcnt)); + if (atomic_dec_and_test(&qp->refcnt)) + complete(&qp->free); + wait_for_completion(&qp->free); if (!qp->is_kernel) { if (qp->rumem) diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c index a2b1a3c..5acebb1 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c @@ -149,7 +149,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd, spin_lock_init(&srq->lock); refcount_set(&srq->refcnt, 1); - init_waitqueue_head(&srq->wait); + init_completion(&srq->free); dev_dbg(&dev->pdev->dev, "create shared receive queue from user space\n"); @@ -236,8 +236,9 @@ static void pvrdma_free_srq(struct pvrdma_dev *dev, struct pvrdma_srq *srq) dev->srq_tbl[srq->srq_handle] = NULL; spin_unlock_irqrestore(&dev->srq_tbl_lock, flags); - if (!refcount_dec_and_test(&srq->refcnt)) - wait_event(srq->wait, !refcount_read(&srq->refcnt)); + if (refcount_dec_and_test(&srq->refcnt)) + complete(&srq->free); + wait_for_completion(&srq->free); /* There is no support for kernel clients, so this is safe. */ ib_umem_release(srq->umem);