Author: np Date: Wed Jun 1 18:46:54 2016 New Revision: 301158 URL: https://svnweb.freebsd.org/changeset/base/301158
Log: iw_cxgbe: Fix panic that occurs when c4iw_ev_handler tries to acquire comp_handler_lock but c4iw_destroy_cq has already freed the CQ memory (which is where the lock resides). Submitted by: Krishnamraju Eraparaju @ Chelsio Sponsored by: Chelsio Communications Modified: head/sys/dev/cxgbe/iw_cxgbe/ev.c Modified: head/sys/dev/cxgbe/iw_cxgbe/ev.c ============================================================================== --- head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:32:20 2016 (r301157) +++ head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:46:54 2016 (r301158) @@ -194,13 +194,22 @@ int c4iw_ev_handler(struct sge_iq *iq, c struct c4iw_cq *chp; unsigned long flag; + spin_lock_irqsave(&dev->lock, flag); chp = get_chp(dev, qid); if (chp) { + atomic_inc(&chp->refcnt); + spin_unlock_irqrestore(&dev->lock, flag); + spin_lock_irqsave(&chp->comp_handler_lock, flag); (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context); spin_unlock_irqrestore(&chp->comp_handler_lock, flag); - } else + if (atomic_dec_and_test(&chp->refcnt)) + wake_up(&chp->wait); + } else { CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid); + spin_unlock_irqrestore(&dev->lock, flag); + } + return 0; } #endif _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"