Author: np
Date: Wed Jun 1 18:46:54 2016
New Revision: 301158
URL: https://svnweb.freebsd.org/changeset/base/301158
Log:
iw_cxgbe: Fix panic that occurs when c4iw_ev_handler tries to acquire
comp_handler_lock but c4iw_destroy_cq has already freed the CQ memory
(which is where the lock resides).
Submitted by: Krishnamraju Eraparaju @ Chelsio
Sponsored by: Chelsio Communications
Modified:
head/sys/dev/cxgbe/iw_cxgbe/ev.c
Modified: head/sys/dev/cxgbe/iw_cxgbe/ev.c
==============================================================================
--- head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:32:20 2016
(r301157)
+++ head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:46:54 2016
(r301158)
@@ -194,13 +194,22 @@ int c4iw_ev_handler(struct sge_iq *iq, c
struct c4iw_cq *chp;
unsigned long flag;
+ spin_lock_irqsave(&dev->lock, flag);
chp = get_chp(dev, qid);
if (chp) {
+ atomic_inc(&chp->refcnt);
+ spin_unlock_irqrestore(&dev->lock, flag);
+
spin_lock_irqsave(&chp->comp_handler_lock, flag);
(*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
spin_unlock_irqrestore(&chp->comp_handler_lock, flag);
- } else
+ if (atomic_dec_and_test(&chp->refcnt))
+ wake_up(&chp->wait);
+ } else {
CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid);
+ spin_unlock_irqrestore(&dev->lock, flag);
+ }
+
return 0;
}
#endif
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
