[openib-general] [PATCH for-2.6.19] IB/ipoib: Fix flush/start xmit race take 2 (from code review)

[Michael S. Tsirkin]

Hello, Roland!
The following patch in the for-2.6.19 series:

    IB/ipoib: Fix flush/start xmit race (from code review)

introduces a sleep-under spinlock condition: we don't drop tx_lock while
scanning remove_list (look at ipoib_flush_paths, I think it'll be obvious).
Here's a fixed version, pls queue in for-2.6.19.

--

ipoib race reported after code review by Eitan Rabin:
http://openib.org/pipermail/openib-general/2006-June/022916.html

Prevent flush task from freeing the ipoib_neigh pointer,
while ipoib_start_xmit is accessing the ipoib_neigh through
the pointer is has loaded from the hardware address.

Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index cf71d2a..31c4b05 100644
Index: ofed_1_1/drivers/infiniband/ulp/ipoib/ipoib_main.c
===================================================================
--- ofed_1_1.orig/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-08-01 15:29:48.000000000 +0300
+++ ofed_1_1/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-09-05 11:47:07.000000000 +0300
@@ -336,7 +336,8 @@ void ipoib_flush_paths(struct net_device
 	struct ipoib_path *path, *tp;
 	LIST_HEAD(remove_list);
 
-	spin_lock_irq(&priv->lock);
+	spin_lock_irq(&priv->tx_lock);
+	spin_lock(&priv->lock);
 
 	list_splice(&priv->path_list, &remove_list);
 	INIT_LIST_HEAD(&priv->path_list);
@@ -347,12 +348,15 @@ void ipoib_flush_paths(struct net_device
 	list_for_each_entry_safe(path, tp, &remove_list, list) {
 		if (path->query)
 			ib_sa_cancel_query(path->query_id, path->query);
-		spin_unlock_irq(&priv->lock);
+		spin_unlock(&priv->lock);
+		spin_unlock_irq(&priv->tx_lock);
 		wait_for_completion(&path->done);
 		path_free(dev, path);
-		spin_lock_irq(&priv->lock);
+		spin_lock_irq(&priv->tx_lock);
+		spin_lock(&priv->lock);
 	}
-	spin_unlock_irq(&priv->lock);
+	spin_unlock(&priv->lock);
+	spin_unlock_irq(&priv->tx_lock);
 }
 
 static void path_rec_completion(int status,

-- 
MST