[openib-general] ipoib_multicast_ah.patch

[Michael S. Tsirkin]

Hi, Roland!
The following issue (ipoib_multicast_ah.patch) was found by code review.
I added a bit more explanations. What do you think now?

---

ipoib_mcast_send tests mcast->ah twice. If this value
is changed between these two points, we leak an skb.

As a solution, take priv->lock around assignment to mcast->ah
thus making sure ipoib_mcast_send is not in flight.

Signed-off-by: Eli Cohen <eli at mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>

Index: linux-2.6.14/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
===================================================================
--- linux-2.6.14.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2006-01-11 14:38:18.000000000 +0200
+++ linux-2.6.14/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2006-01-11 14:38:23.000000000 +0200
@@ -210,6 +210,8 @@ static int ipoib_mcast_join_finish(struc
 {
 	struct net_device *dev = mcast->dev;
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
+	struct ipoib_ah *ah;
+	unsigned long flags;
 	int ret;
 
 	mcast->mcmember = *mcmember;
@@ -266,8 +268,8 @@ static int ipoib_mcast_join_finish(struc
 				av.static_rate, priv->local_rate,
 				ib_sa_rate_enum_to_int(mcast->mcmember.rate));
 
-		mcast->ah = ipoib_create_ah(dev, priv->pd, &av);
-		if (!mcast->ah) {
+		ah = ipoib_create_ah(dev, priv->pd, &av);
+		if (!ah) {
 			ipoib_warn(priv, "ib_address_create failed\n");
 		} else {
 			ipoib_dbg_mcast(priv, "MGID " IPOIB_GID_FMT
@@ -277,6 +279,9 @@ static int ipoib_mcast_join_finish(struc
 					be16_to_cpu(mcast->mcmember.mlid),
 					mcast->mcmember.sl);
 		}
+		spin_lock_irqsave(&priv->lock, flags);
+		mcast->ah = ah;
+		spin_unlock_irqrestore(&priv->lock, flags);
 	}
 
 	/* actually send any queued packets */

-- 
Michael S. Tsirkin
Staff Engineer, Mellanox Technologies