Hi, Roland!
The following issue (ipoib_multicast_ah.patch) was found by code review.
I added a bit more explanations. What do you think now?
---
ipoib_mcast_send tests mcast->ah twice. If this value
is changed between these two points, we leak an skb.
As a solution, take priv->lock around assignment to mcast->ah
thus making sure ipoib_mcast_send is not in flight.
Signed-off-by: Eli Cohen <[EMAIL PROTECTED]>
Signed-off-by: Michael S. Tsirkin <[EMAIL PROTECTED]>
Index: linux-2.6.14/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
===================================================================
--- linux-2.6.14.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
2006-01-11 14:38:18.000000000 +0200
+++ linux-2.6.14/drivers/infiniband/ulp/ipoib/ipoib_multicast.c 2006-01-11
14:38:23.000000000 +0200
@@ -210,6 +210,8 @@ static int ipoib_mcast_join_finish(struc
{
struct net_device *dev = mcast->dev;
struct ipoib_dev_priv *priv = netdev_priv(dev);
+ struct ipoib_ah *ah;
+ unsigned long flags;
int ret;
mcast->mcmember = *mcmember;
@@ -266,8 +268,8 @@ static int ipoib_mcast_join_finish(struc
av.static_rate, priv->local_rate,
ib_sa_rate_enum_to_int(mcast->mcmember.rate));
- mcast->ah = ipoib_create_ah(dev, priv->pd, &av);
- if (!mcast->ah) {
+ ah = ipoib_create_ah(dev, priv->pd, &av);
+ if (!ah) {
ipoib_warn(priv, "ib_address_create failed\n");
} else {
ipoib_dbg_mcast(priv, "MGID " IPOIB_GID_FMT
@@ -277,6 +279,9 @@ static int ipoib_mcast_join_finish(struc
be16_to_cpu(mcast->mcmember.mlid),
mcast->mcmember.sl);
}
+ spin_lock_irqsave(&priv->lock, flags);
+ mcast->ah = ah;
+ spin_unlock_irqrestore(&priv->lock, flags);
}
/* actually send any queued packets */
--
Michael S. Tsirkin
Staff Engineer, Mellanox Technologies
_______________________________________________
openib-general mailing list
openib-general@openib.org
http://openib.org/mailman/listinfo/openib-general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
