This is a note to let you know that I've just added the patch titled IB/ipoib: Fix deadlock over vlan_mutex to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ib-ipoib-fix-deadlock-over-vlan_mutex.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Oct 5 10:58:04 CEST 2017 From: Feras Daoud <ferasda@xxxxxxxxxxxx> Date: Wed, 28 Dec 2016 14:47:22 +0200 Subject: IB/ipoib: Fix deadlock over vlan_mutex From: Feras Daoud <ferasda@xxxxxxxxxxxx> [ Upstream commit 1c3098cdb05207e740715857df7b0998e372f527 ] This patch fixes Deadlock while executing ipoib_vlan_delete. The function takes the vlan_rwsem semaphore and calls unregister_netdevice. The later function calls ipoib_mcast_stop_thread that cause workqueue flush. When the queue has one of the ipoib_ib_dev_flush_xxx events, a deadlock occur because these events also tries to catch the same vlan_rwsem semaphore. To fix, unregister_netdevice should be called after releasing the semaphore. Fixes: cbbe1efa4972 ("IPoIB: Fix deadlock between ipoib_open() and child interface create") Signed-off-by: Feras Daoud <ferasda@xxxxxxxxxxxx> Signed-off-by: Erez Shitrit <erezsh@xxxxxxxxxxxx> Reviewed-by: Alex Vesker <valex@xxxxxxxxxxxx> Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx> Signed-off-by: Doug Ledford <dledford@xxxxxxxxxx> Signed-off-by: Sasha Levin <alexander.levin@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c @@ -187,7 +187,6 @@ int ipoib_vlan_delete(struct net_device list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) { if (priv->pkey == pkey && priv->child_type == IPOIB_LEGACY_CHILD) { - unregister_netdevice(priv->dev); list_del(&priv->list); dev = priv->dev; break; @@ -195,6 +194,11 @@ int ipoib_vlan_delete(struct net_device } up_write(&ppriv->vlan_rwsem); + if (dev) { + ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name); + unregister_netdevice(dev); + } + rtnl_unlock(); if (dev) { Patches currently in stable-queue which might be from ferasda@xxxxxxxxxxxx are queue-3.18/ib-ipoib-replace-list_del-of-the-neigh-list-with-list_del_init.patch queue-3.18/ib-ipoib-rtnl_unlock-can-not-come-after-free_netdev.patch queue-3.18/ib-ipoib-fix-deadlock-over-vlan_mutex.patch