From: Amir Vadai Date: Wed, 23 Jun 2010 08:07:36 +0000 (+0300) Subject: sdp: sdp_destroy_qp should be protected in destroy work X-Git-Tag: v4.1.12-92~264^2~5^2~157 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=be4df8381cf08c09e3ab246de6da14e9c205d622;p=users%2Fjedix%2Flinux-maple.git sdp: sdp_destroy_qp should be protected in destroy work sdp_destroy_work didn't take a lock before destorying QP Signed-off-by: Amir Vadai --- diff --git a/drivers/infiniband/ulp/sdp/sdp_main.c b/drivers/infiniband/ulp/sdp/sdp_main.c index 7521478a7f085..46b517272b61f 100644 --- a/drivers/infiniband/ulp/sdp/sdp_main.c +++ b/drivers/infiniband/ulp/sdp/sdp_main.c @@ -1027,14 +1027,18 @@ static void sdp_destroy_work(struct work_struct *work) struct sock *sk = &ssk->isk.sk; sdp_dbg(sk, "%s: refcnt %d\n", __func__, atomic_read(&sk->sk_refcnt)); + lock_sock(sk); sdp_destroy_qp(ssk); + release_sock(sk); /* Can be sure that rx_comp_work won't be queued from here cause * ssk->rx_ring.cq is NULL from here */ cancel_work_sync(&ssk->rx_comp_work); + lock_sock(sk); memset((void *)&ssk->id, 0, sizeof(*ssk) - offsetof(typeof(*ssk), id)); + release_sock(sk); sdp_cancel_dreq_wait_timeout(ssk); @@ -1045,10 +1049,13 @@ static void sdp_destroy_work(struct work_struct *work) sock_put(sk, SOCK_REF_CMA); } + lock_sock(sk); /* In normal close current state is TCP_TIME_WAIT or TCP_CLOSE but if a CM connection is dropped below our legs state could be any state */ sdp_exch_state(sk, ~0, TCP_CLOSE); + release_sock(sk); + sock_put(sk, SOCK_REF_RESET); }