On Tue, Dec 27, 2016 at 03:39:11PM +0200, Leon Romanovsky wrote:
> From: Feras Daoud <ferasda@xxxxxxxxxxxx>
>
> Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
> belong to different work queues, they can run in parallel.
> In this case if ipoib_cm_tx_reap calls list_del and release the
> lock, ipoib_cm_tx_start may acquire it and call list_del_init
> on the already deleted object.
> Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.
>
> Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
> Signed-off-by: Feras Daoud <ferasda@xxxxxxxxxxxx>
> Signed-off-by: Erez Shitrit <erezsh@xxxxxxxxxxxx>
> Reviewed-by: Alex Vesker <valex@xxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
> ---
> drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> index b6444b2..cc08379 100644
> --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> @@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
>
> while (!list_empty(&priv->cm.reap_list)) {
> p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
> - list_del(&p->list);
> + list_del_init(&p->list);
> spin_unlock_irqrestore(&priv->lock, flags);
> netif_tx_unlock_bh(dev);
> ipoib_cm_tx_destroy(p);
> --
Reviewed-by: Yuval Shaia <yuval.shaia@xxxxxxxxxx>
> 2.10.2
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
