linux/drivers/infiniband
Jack Morgenstein 6b708b3dde IB/sa_query: Fix AH leak due to update_sm_ah() race
Our testing uncovered a race condition in ib_sa_event():

	spin_lock_irqsave(&port->ah_lock, flags);
	if (port->sm_ah)
		kref_put(&port->sm_ah->ref, free_sm_ah);
	port->sm_ah = NULL;
	spin_unlock_irqrestore(&port->ah_lock, flags);

	schedule_work(&sa_dev->port[event->element.port_num -
				    sa_dev->start_port].update_task);

If two events occur back-to-back (e.g., client-reregister and LID
change), both may pass the spinlock-protected code above before the
scheduled work updates the port->sm_ah handle.  Then if the scheduled
work ends up running twice, the second operation will then find a
non-NULL port->sm_ah, and will simply overwrite it in update_sm_ah --
resulting in an AH leak.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
2009-03-03 14:30:01 -08:00
..
core IB/sa_query: Fix AH leak due to update_sm_ah() race 2009-03-03 14:30:01 -08:00
hw Merge branches 'ehca', 'ipoib' and 'mlx4' into for-linus 2009-01-16 15:05:54 -08:00
ulp IPoIB: Do not print error messages for multicast join retries 2009-01-16 13:42:59 -08:00
Kconfig RDMA/addr: Fix build breakage when IPv6 is disabled 2008-12-29 23:37:14 -08:00
Makefile RDMA/nes: Add a driver for NetEffect RNICs 2008-02-04 20:20:45 -08:00