[ofa-general] [PATCH 1/2] IB/core: handle race between elements in qork queues after event

[Roland Dreier]

 > > 		spin_lock_irqsave(&port->ah_lock, flags);
 > > 		if (port->sm_ah)
 > > 			kref_put(&port->sm_ah->ref, free_sm_ah);
 > > 		port->sm_ah = NULL;
 > > 		spin_unlock_irqrestore(&port->ah_lock, flags);
 > > 
 > What happens if this happens
 > 
 > # |         CPU-0					|	CPU-1
 >   |      						|
 > 1 | if (port->sm_ah)					|
 >   |      kref_put(&port->sm_ah->ref, free_sm_ah);	|
 > --+-----------------------------------------------------+-----------------------
 > 2 |							| alloc_mad() 
 > --+-----------------------------------------------------+-----------------------
 > 3 | port->sm_ah = NULL;					|
 > 
 > As I see it, process on CPU-1 gets a garbage sm_ah
 > Do you agree?

alloc_mad() must obviously take the lock when looking at port->sm_ah,
and take a reference with kref_get() before dropping the lock.

 - R.