@@ -1045,6 +1045,7 @@ int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
struct bnx2fc_work *work = NULL;
struct bnx2fc_percpu_s *fps = NULL;
unsigned int cpu = wqe % num_possible_cpus();
+ bool process = true;
fps = &per_cpu(bnx2fc_percpu, cpu);
spin_lock_bh(&fps->fp_work_lock);
@@ -1052,16 +1053,16 @@ int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
goto unlock;
work = bnx2fc_alloc_work(tgt, wqe);
- if (work)
+ if (work) {
list_add_tail(&work->list,
&fps->work_list);
+ wake_up_process(fps->iothread);
+ process = false;
+ }
unlock:
spin_unlock_bh(&fps->fp_work_lock);
- /* Pending work request completion */
- if (fps->iothread && work)
- wake_up_process(fps->iothread);
- else
+ if (process)
bnx2fc_process_cq_compl(tgt, wqe);
num_free_sqes++;
}
The ->iothread is accessed without holding the lock. Take this: CPU A CPU B ------- ------- bnx2fc_process_new_cqes() bnx2fc_percpu_thread_destroy() spin_lock_bh(fp_work_lock); fps->iothread != NULL list_add_tail(work) spin_unlock_bh(&fps->fp_work_lock); spin_lock_bh(&fps->fp_work_lock); fps->iothread = NULL if (fps->iothread && work) ... else bnx2fc_process_cq_compl(work) bnx2fc_process_cq_compl(work); CPU A will process wqe despite having it added to the work list of CPU B which will at the same time clean up the queued wqe. The fix is to add the item to the list and wakeup the thread while still holding the lock. If the item was not added to the list then the `process' variable is still true in which case we have to do manually. Cc: QLogic-Storage-Upstream@qlogic.com Cc: "James E.J. Bottomley" <JBottomley@odin.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Christoph Hellwig <hch@lst.de> Cc: linux-scsi@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> --- drivers/scsi/bnx2fc/bnx2fc_hwi.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)