IB/ipoib: Fix flush/start xmit race (from code review)

Prevent flush task from freeing the ipoib_neigh pointer, while
ipoib_start_xmit() is accessing the ipoib_neigh through the pointer it
has loaded from the skb's hardware address.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index cf71d2a5515c1d734026827355680847a6a51893..36d76987a481179bd3cded4f7283f0477b93fced 100644 (file)
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -336,7 +336,8 @@ void ipoib_flush_paths(struct net_device *dev)
        struct ipoib_path *path, *tp;
        LIST_HEAD(remove_list);
 
-       spin_lock_irq(&priv->lock);
+       spin_lock_irq(&priv->tx_lock);
+       spin_lock(&priv->lock);
 
        list_splice(&priv->path_list, &remove_list);
        INIT_LIST_HEAD(&priv->path_list);
@@ -347,12 +348,15 @@ void ipoib_flush_paths(struct net_device *dev)
        list_for_each_entry_safe(path, tp, &remove_list, list) {
                if (path->query)
                        ib_sa_cancel_query(path->query_id, path->query);
-               spin_unlock_irq(&priv->lock);
+               spin_unlock(&priv->lock);
+               spin_unlock_irq(&priv->tx_lock);
                wait_for_completion(&path->done);
                path_free(dev, path);
-               spin_lock_irq(&priv->lock);
+               spin_lock_irq(&priv->tx_lock);
+               spin_lock(&priv->lock);
        }
-       spin_unlock_irq(&priv->lock);
+       spin_unlock(&priv->lock);
+       spin_unlock_irq(&priv->tx_lock);
 }
 
 static void path_rec_completion(int status,