lkml.org 
[lkml]   [2012]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 22/86] RDMA/core: Fix kernel panic by always initializing qp->usecnt
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>

    commit e47e321a35c741ee41b67976f8c6a3a7a42bc5c0 upstream.

    We have just been investigating kernel panics related to
    cq->ibcq.event_handler() completion calls. The problem is that
    ib_destroy_qp() fails with -EBUSY.

    Further investigation revealed qp->usecnt is not initialized. This
    counter was introduced in linux-3.2 by commit 0e0ec7e0638e
    ("RDMA/core: Export ib_open_qp() to share XRC TGT QPs") but it only
    gets initialized for IB_QPT_XRC_TGT, but it is checked in
    ib_destroy_qp() for any QP type.

    Fix this by initializing qp->usecnt for every QP we create.

    Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Signed-off-by: Sven Breuner <sven.breuner@itwm.fraunhofer.de>

    [ Initialize qp->usecnt in uverbs too. - Sean ]

    Signed-off-by: Sean Hefty <sean.hefty@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/infiniband/core/uverbs_cmd.c | 1 +
    drivers/infiniband/core/verbs.c | 2 +-
    2 files changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/infiniband/core/uverbs_cmd.c
    +++ b/drivers/infiniband/core/uverbs_cmd.c
    @@ -1485,6 +1485,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uv
    qp->event_handler = attr.event_handler;
    qp->qp_context = attr.qp_context;
    qp->qp_type = attr.qp_type;
    + atomic_set(&qp->usecnt, 0);
    atomic_inc(&pd->usecnt);
    atomic_inc(&attr.send_cq->usecnt);
    if (attr.recv_cq)
    --- a/drivers/infiniband/core/verbs.c
    +++ b/drivers/infiniband/core/verbs.c
    @@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd
    qp->uobject = NULL;
    qp->qp_type = qp_init_attr->qp_type;

    + atomic_set(&qp->usecnt, 0);
    if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
    qp->event_handler = __ib_shared_qp_event_handler;
    qp->qp_context = qp;
    @@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd
    qp->xrcd = qp_init_attr->xrcd;
    atomic_inc(&qp_init_attr->xrcd->usecnt);
    INIT_LIST_HEAD(&qp->open_list);
    - atomic_set(&qp->usecnt, 0);

    real_qp = qp;
    qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,



    \
     
     \ /
      Last update: 2012-02-11 00:23    [W:0.024 / U:31.100 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site