[ofa-general] [RFC][PATCH] last recv race patch

[Shirley Ma]

Hello Roland,

      We have found several panics and memory leak for IPoIB-CM. I reviewed
the code and caught some issues. I will start to submit a list of patches
for review. i have tested the combined patch for connectX, it passed 24
hours 16 netperf/netserver bidirctional TCP, UDP stream test for 2.7.26-rc6
kernel.

      I turned on debug, I found that same QP context being destoryed twice
for nonSRQ connection. I reviewed the code and found that there is a window
the list could be added after the reap call, so checking the QP context
status is needed.

      My linux email client is broken, so I attach each patch here.

Address a possible race
-------------------
Signed-off-by: Shirley Ma <xma at us.ibm.com>

 drivers/infiniband/ulp/ipoib/ipoib_cm.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 97e67d3..0886ee7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -559,9 +559,12 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
            else {
                  if (!--p->recv_count) {
                        spin_lock_irqsave(&priv->lock, flags);
-                       list_move(&p->list, &priv->cm.rx_reap_list);
-                       spin_unlock_irqrestore(&priv->lock, flags);
-                       queue_work(ipoib_workqueue, &priv->cm.rx_reap_task);
+                       if (p->state == IPOIB_CM_RX_LIVE) {
+                             list_move(&p->list, &priv->cm.rx_reap_list);
+                             spin_unlock_irqrestore(&priv->lock, flags);
+                             queue_work(ipoib_workqueue, &priv->cm.rx_reap_task);
+                       } else
+                             spin_unlock_irqrestore(&priv->lock, flags);
                  }
                  return;
            }

(See attached file: nonsrq_last_recv_race.patch)

Thanks
Shirley
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openfabrics.org/pipermail/general/attachments/20080624/5b6b73c7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: nonsrq_last_recv_race.patch
Type: application/octet-stream
Size: 1031 bytes
Desc: not available
URL: <http://lists.openfabrics.org/pipermail/general/attachments/20080624/5b6b73c7/attachment.obj>