IPoIB: Test for NULL broadcast object in ipiob_mcast_join_finish()
authorJack Morgenstein <jackm@dev.mellanox.co.il>
Tue, 20 May 2008 22:41:09 +0000 (15:41 -0700)
committerRoland Dreier <rolandd@cisco.com>
Tue, 20 May 2008 22:41:09 +0000 (15:41 -0700)
We saw a kernel oops in our regression testing when a multicast "join
finish" occurred just after the interface was -- this is
<https://bugs.openfabrics.org/show_bug.cgi?id=1040>.  The test
randomly causes the HCA physical port to go down then up.

The cause of this is that ipoib_mcast_join_finish() processing happen
just after ipoib_mcast_dev_flush() was invoked (in which case the
broadcast pointer is NULL).  This patch tests for and handles the case
where priv->broadcast is NULL.

Cc: <stable@kernel.org>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/ulp/ipoib/ipoib_multicast.c

index d00a2c174aee2c2c3a91453f94b2fb51d3840b2c..3f663fb852c1c627462807fd4348649eeda451d1 100644 (file)
@@ -194,7 +194,13 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
        /* Set the cached Q_Key before we attach if it's the broadcast group */
        if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
                    sizeof (union ib_gid))) {
+               spin_lock_irq(&priv->lock);
+               if (!priv->broadcast) {
+                       spin_unlock_irq(&priv->lock);
+                       return -EAGAIN;
+               }
                priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
+               spin_unlock_irq(&priv->lock);
                priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
        }