IB/rxe: Hold refs when running tasklets

Browse source

It might be possible for all of a QP's references to be dropped
while one of that QP's tasklets is running.

For example, the completer might run during QP destroy.
If qp->valid is false, it will drop all of the packets on
the resp_pkts list, potentially removing the last reference.
Then it tries to advance the SQ consumer pointer. If the
SQ's buffer has already been destroyed, the system will
panic.

To be safe, hold a reference on the QP for the duration
of each tasklet.

Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

...

This commit is contained in:

Andrew Boyer 2016-12-05 08:43:21 -05:00 • committed by Doug Ledford

parent 07bf9627d5

commit 37f69f43fb

3 changed files with 11 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/infiniband/sw/rxe/rxe_comp.c

View file

5

drivers/infiniband/sw/rxe/rxe_req.c

View file

3

drivers/infiniband/sw/rxe/rxe_resp.c

View file