[openib-general] [PATCH] ipoib: mcast->ah race

[Michael S. Tsirkin]

ipoib_mcast_send tests mcast->ah twice. If this value
is changed between these two points, we leak an skb.

Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>

Index: openib/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
===================================================================
--- openib/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	(revision 4872)
+++ openib/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	(working copy)
@@ -206,6 +206,7 @@ static int ipoib_mcast_join_finish(struc
 {
 	struct net_device *dev = mcast->dev;
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
+	unsigned long flags;
 	int ret;
 
 	mcast->mcmember = *mcmember;
@@ -262,6 +263,7 @@ static int ipoib_mcast_join_finish(struc
 				av.static_rate, priv->local_rate,
 				ib_sa_rate_enum_to_int(mcast->mcmember.rate));
 
+		spin_lock_irqsave(&priv->lock, flags);
 		mcast->ah = ipoib_create_ah(dev, priv->pd, &av);
 		if (!mcast->ah) {
 			ipoib_warn(priv, "ib_address_create failed\n");
@@ -273,6 +275,7 @@ static int ipoib_mcast_join_finish(struc
 					be16_to_cpu(mcast->mcmember.mlid),
 					mcast->mcmember.sl);
 		}
+		spin_unlock_irqrestore(&priv->lock, flags);
 	}
 
 	/* actually send any queued packets */

-- 
MST