[ofa-general] [RFC] ipoib: avoid using stale ipoib_neigh* in ipoib_neigh_cleanup()

[akepner at sgi.com]

On Sun, May 24, 2009 at 08:11:32AM +0300, Or Gerlitz wrote:

> ... how come a neigh cleanup 
> callback is invoked when someone out there has a ref on the neighbour? 

Don't know if you saw all of this thread, but in:

http://lists.openfabrics.org/pipermail/general/2009-May/059730.html

I mentioned a race between a tx completion (with an error) and 
ipoib_neigh_cleanup(), which could happen even if the callback 
is invoked at the correct time (as far as the neighbour code is 
concerned).

> ...
> also I'd like to clarify with you if the rest of this thread applies 
> only to 2.6.16 and possibly more old kernels, or to the current mainline 
> bits?
> 

Although I've only seen the bug with 2.6.16 vintage kernels (and 
maybe only once) , I think it's still possible in the latest code 
via the mechanism I mentioned above (and maybe other ways, too). 

The best idea I've got so far is to use a new set of locks to 
consistently read/write the struct ipoib_neigh pointer that's 
stashed away in the neighbour structures. 

-- 
Arthur