Messages in this thread | | | From | "Marciniszyn, Mike" <> | Subject | RE: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock() | Date | Wed, 12 Feb 2014 14:57:14 +0000 |
| |
BTW, I am considering eliminating the atomic_inc() in favor of widening the scope of the rcu lock expanse.
Mike
> -----Original Message----- > From: Paul E. McKenney [mailto:paulmck@linux.vnet.ibm.com] > Sent: Wednesday, February 12, 2014 9:56 AM > To: Marciniszyn, Mike > Cc: roland@kernel.org; Hefty, Sean; hal.rosenstock@gmail.com; linux- > rdma@vger.kernel.org; linux-kernel@vger.kernel.org > Subject: Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock() > > On Wed, Feb 12, 2014 at 01:59:30PM +0000, Marciniszyn, Mike wrote: > > > So what am I missing here? > > > > > > > The atomic increment of a reference count: > > Got it, thank you, apologies for the noise! > > Thanx, Paul > > > struct qib_qp *qib_lookup_qpn(struct qib_ibport *ibp, u32 qpn) { > > struct qib_qp *qp = NULL; > > > > rcu_read_lock(); > > if (unlikely(qpn <= 1)) { > > if (qpn == 0) > > qp = rcu_dereference(ibp->qp0); > > else > > qp = rcu_dereference(ibp->qp1); > > if (qp) > > atomic_inc(&qp->refcount); <-------------------------- > > } else { > > struct qib_ibdev *dev = &ppd_from_ibp(ibp)->dd->verbs_dev; > > unsigned n = qpn_hash(dev, qpn); > > > > for (qp = rcu_dereference(dev->qp_table[n]); qp; > > qp = rcu_dereference(qp->next)) > > if (qp->ibqp.qp_num == qpn) { > > atomic_inc(&qp->refcount); <--------------------- > > break; > > } > > } > > rcu_read_unlock(); > > return qp; > > } > > > > Mike > >
| |