[ofa-general] [PATCH] IPoIB: fix race when manipulating mcast SKBs queue

[Eli Cohen]

ipoib_mcast_free() dequeues SKBs pending on the pkt_queue but needs to do that
with netif_tx_lock_bh() acquired.

Signed-off-by: Eli Cohen <eli at mellanox.co.il>
---

I saw the following bug appear in ofed 1.4 on RHAS5.2 but have not yet had the
chance to verify that this patch fixes this particular problem but I think this
patch is valid anyway:

Dec 13 04:57:26 mtilab17 kernel: ib0: dev_queue_xmit failed to requeue packet
Dec 13 04:57:36 mtilab17 kernel: ib0: timing out; 63 sends not completed
Dec 13 04:57:36 mtilab17 kernel: Attempt to release alive inet socket ffff8102621d3680
Dec 13 04:57:36 mtilab17 kernel: Attempt to release alive inet socket ffff81026ba4b0c0
Dec 13 04:57:36 mtilab17 kernel: BUG: warning at include/net/dst.h:153/dst_release() (Tainted: G     )
Dec 13 04:57:36 mtilab17 kernel:
Dec 13 04:57:36 mtilab17 kernel: Call Trace:
Dec 13 04:57:36 mtilab17 kernel:  <IRQ>  [<ffffffff800288ef>] __kfree_skb+0x47/0x110
Dec 13 04:57:36 mtilab17 kernel:  [<ffffffff885d69ce>] :ib_ipoib:ipoib_cm_handle_tx_wc+0xc2/0x228
Dec 13 04:57:36 mtilab17 kernel:  [<ffffffff885cfae2>] :ib_ipoib:ipoib_poll+0xaa/0x19e
Dec 13 04:57:36 mtilab17 kernel:  [<ffffffff8000c54c>] net_rx_action+0xa4/0x1a4
Dec 13 04:57:36 mtilab17 kernel:  [<ffffffff8832da0a>] :mlx4_core:poll_catas+0x0/0x137
---
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index d9d1223..dd320d5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -94,12 +94,12 @@ static void ipoib_mcast_free(struct ipoib_mcast *mcast)
 	if (mcast->ah)
 		ipoib_put_ah(mcast->ah);
 
+	netif_tx_lock_bh(dev);
 	while (!skb_queue_empty(&mcast->pkt_queue)) {
 		++tx_dropped;
 		dev_kfree_skb_any(skb_dequeue(&mcast->pkt_queue));
 	}
 
-	netif_tx_lock_bh(dev);
 	dev->stats.tx_dropped += tx_dropped;
 	netif_tx_unlock_bh(dev);
 
-- 
1.6.0.5