From: Eli Cohen Date: Wed, 5 Apr 2006 12:59:34 +0000 (+0300) Subject: IPoIB: Close race in ipoib_flush_paths() X-Git-Tag: v2.6.17-rc2~79^2~3 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a30bb96c6f5aca6513e4dbd94962da03d14b20a9;p=linux-2.6 IPoIB: Close race in ipoib_flush_paths() ib_sa_cancel_query() must be called with priv->lock held since a completion might arrive and set path->query to NULL. Signed-off-by: Eli Cohen Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c index 5bf7e26345..996c6e16a4 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c @@ -346,14 +346,15 @@ void ipoib_flush_paths(struct net_device *dev) list_for_each_entry(path, &remove_list, list) rb_erase(&path->rb_node, &priv->path_tree); - spin_unlock_irqrestore(&priv->lock, flags); - list_for_each_entry_safe(path, tp, &remove_list, list) { if (path->query) ib_sa_cancel_query(path->query_id, path->query); + spin_unlock_irqrestore(&priv->lock, flags); wait_for_completion(&path->done); path_free(dev, path); + spin_lock_irqsave(&priv->lock, flags); } + spin_unlock_irqrestore(&priv->lock, flags); } static void path_rec_completion(int status,