[openib-general] Re: [PATCH]Repost: IPoIB skb panic

[Roland Dreier]

 > The skb has only one prev, one next pointers, it can only be on one list
 > at a time. How could skb go on two lists at once?

Good question.  Actually I was wrong about understanding things
before.  I don't see any way that path_free() and unicast_arp_send()
can be operating on the same struct ipoib_path at the same time.  And
I don't see how unicast_arp_send() could be handling the an skb that's
already queued in a path's queue.

path_free() only gets called from ipoib_flush_paths() after the path
has been removed from the list of paths and the rb_tree of paths (both
protected by priv->lock), so unicast_arp_send() wouldn't find the path
to queue an skb.  And ipoib_flush_paths() can't find a new path
created by unicast_arp_send().

Obviously I'm missing something but I still don't see the real cause
of your crash.

 - R.