diff options
| author | Michael S. Tsirkin <mst@mellanox.co.il> | 2006-01-30 16:22:29 -0800 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2006-01-30 16:22:29 -0800 |
| commit | e3aa31c517cb6fd0a3d8b23e6a7e71a6aafc2393 (patch) | |
| tree | 97c1ca504dc60a7b380be402b91af59a4a8f8e04 | |
| parent | 8e9e5f4f5eb1d44ddabfd1ddea4ca4e4244a9ffb (diff) | |
| download | lwn-e3aa31c517cb6fd0a3d8b23e6a7e71a6aafc2393.tar.gz lwn-e3aa31c517cb6fd0a3d8b23e6a7e71a6aafc2393.zip | |
IB/mthca: Don't cancel commands on a signal
We have run into the following problem: if a task receives a signal
while in the process of e.g. destroying a resource (which could be
because the relevant file was closed) mthca could bail out from trying
to take a command interface semaphore without performing the
appropriate command to tell hardware that the resource is being
destroyed.
As a result we see messages like
ib_mthca 0000:04:00.0: HW2SW_CQ failed (-4)
In this case, hardware could access the resource after the memory has
been freed, possibly causing memory corruption.
A simple solution is to replace down_interruptible() by down() in
command interface activation.
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
[ It's also not safe to bail out on multicast table operations, since
they may be invoked on the cleanup path too. So use down() for
mcg_table.sem too. ]
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | drivers/infiniband/hw/mthca/mthca_cmd.c | 9 | ||||
| -rw-r--r-- | drivers/infiniband/hw/mthca/mthca_mcg.c | 14 |
2 files changed, 7 insertions, 16 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c index be1791be627b..69128fe60c53 100644 --- a/drivers/infiniband/hw/mthca/mthca_cmd.c +++ b/drivers/infiniband/hw/mthca/mthca_cmd.c @@ -199,8 +199,7 @@ static int mthca_cmd_post(struct mthca_dev *dev, { int err = 0; - if (down_interruptible(&dev->cmd.hcr_sem)) - return -EINTR; + down(&dev->cmd.hcr_sem); if (event) { unsigned long end = jiffies + GO_BIT_TIMEOUT; @@ -255,8 +254,7 @@ static int mthca_cmd_poll(struct mthca_dev *dev, int err = 0; unsigned long end; - if (down_interruptible(&dev->cmd.poll_sem)) - return -EINTR; + down(&dev->cmd.poll_sem); err = mthca_cmd_post(dev, in_param, out_param ? *out_param : 0, @@ -333,8 +331,7 @@ static int mthca_cmd_wait(struct mthca_dev *dev, int err = 0; struct mthca_cmd_context *context; - if (down_interruptible(&dev->cmd.event_sem)) - return -EINTR; + down(&dev->cmd.event_sem); spin_lock(&dev->cmd.context_lock); BUG_ON(dev->cmd.free_head < 0); diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c index 77bc6c746f43..55ff5e5bcfef 100644 --- a/drivers/infiniband/hw/mthca/mthca_mcg.c +++ b/drivers/infiniband/hw/mthca/mthca_mcg.c @@ -154,10 +154,7 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) return PTR_ERR(mailbox); mgm = mailbox->buf; - if (down_interruptible(&dev->mcg_table.sem)) { - err = -EINTR; - goto err_sem; - } + down(&dev->mcg_table.sem); err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index); if (err) @@ -242,7 +239,7 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) mthca_free(&dev->mcg_table.alloc, index); } up(&dev->mcg_table.sem); - err_sem: + mthca_free_mailbox(dev, mailbox); return err; } @@ -263,10 +260,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) return PTR_ERR(mailbox); mgm = mailbox->buf; - if (down_interruptible(&dev->mcg_table.sem)) { - err = -EINTR; - goto err_sem; - } + down(&dev->mcg_table.sem); err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index); if (err) @@ -372,7 +366,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) out: up(&dev->mcg_table.sem); - err_sem: + mthca_free_mailbox(dev, mailbox); return err; } |