Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] IB: Fix race in sa_query

Browse source 
Use a copy of the id we'll return to the consumer so that we don't
dereference query->sa_query after calling send_mad().  A completion may
occur very quickly and end up freeing the query before we get to do
anything after send_mad().

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Roland Dreier 2005-06-27 14:36:46 -07:00 committed by Linus Torvalds
parent cae54bdf6f
commit dae4c1d236
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/infiniband/core/sa_query.c
View file

@ -507,7 +507,13 @@ static int send_mad(struct ib_sa_query *query, int timeout_ms)
spin_unlock_irqrestore(&idr_lock, flags);
}
return ret;
/*
* It's not safe to dereference query any more, because the
* send may already have completed and freed the query in
* another context. So use wr.wr_id, which has a copy of the
* query's id.
*/
return ret ? ret : wr.wr_id;
}
static void ib_sa_path_rec_callback(struct ib_sa_query *sa_query,
@ -598,14 +604,15 @@ int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
rec, query->sa_query.mad->data);
*sa_query = &query->sa_query;
ret = send_mad(&query->sa_query, timeout_ms);
if (ret) {
if (ret < 0) {
*sa_query = NULL;
kfree(query->sa_query.mad);
kfree(query);
}
return ret ? ret : query->sa_query.id;
return ret;
}
EXPORT_SYMBOL(ib_sa_path_rec_get);
@ -674,14 +681,15 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
rec, query->sa_query.mad->data);
*sa_query = &query->sa_query;
ret = send_mad(&query->sa_query, timeout_ms);
if (ret) {
if (ret < 0) {
*sa_query = NULL;
kfree(query->sa_query.mad);
kfree(query);
}
return ret ? ret : query->sa_query.id;
return ret;
}
EXPORT_SYMBOL(ib_sa_mcmember_rec_query);