diff options
| author | Andrew Boyer <andrew.boyer@dell.com> | 2016-12-05 08:43:21 -0500 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2016-12-12 16:34:22 -0500 |
| commit | 37f69f43fb5aba4288d38ea32bbe0dfdb412c763 (patch) | |
| tree | e7d01aaa85ce347d6858ad09c3369b0580b2ccd2 /drivers/infiniband/sw/rxe/rxe_resp.c | |
| parent | 07bf9627d5f1c0334fc543a5435a31a3b5907944 (diff) | |
IB/rxe: Hold refs when running tasklets
It might be possible for all of a QP's references to be dropped
while one of that QP's tasklets is running.
For example, the completer might run during QP destroy.
If qp->valid is false, it will drop all of the packets on
the resp_pkts list, potentially removing the last reference.
Then it tries to advance the SQ consumer pointer. If the
SQ's buffer has already been destroyed, the system will
panic.
To be safe, hold a reference on the QP for the duration
of each tasklet.
Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_resp.c')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_resp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 8643797fb530..7a36ec9dbc0c 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -1212,6 +1212,8 @@ int rxe_responder(void *arg) struct rxe_pkt_info *pkt = NULL; int ret = 0; + rxe_add_ref(qp); + qp->resp.aeth_syndrome = AETH_ACK_UNLIMITED; if (!qp->valid) { @@ -1400,5 +1402,6 @@ int rxe_responder(void *arg) exit: ret = -EAGAIN; done: + rxe_drop_ref(qp); return ret; } |