[openib-general] Re: [PATCH]Repost: IPoIB skb panic

[Eli Cohen]

> More clarification: we saw two races here:
> 1. path_free() was called by both unicast_arp_send() and
> ipoib_flush_paths() in the same time.

It is not possible to call path_free() on the same object from both
unicast_arp_send() and ipoib_flush_paths(). This becasue
unicast_arp_send() calls it only for newly created objects for which
path_rec_create() failed, in which case the object was never inserted
into the list or the rb_tree.

> 2. during unicast arp skb retransmission, unicast_arp_send() appended
> the skb on the list, while ipoib_flush_paths() calling path_free() to
> free the same skb from the list.

I don't see any issue here as well.

Can you reproduce the crash? If you do, can you send how?