summaryrefslogtreecommitdiff
path: root/include/linux
diff options
context:
space:
mode:
authorEran Ben Elisha <eranbe@mellanox.com>2020-08-04 10:40:21 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-10-14 10:33:04 +0200
commit073fff8102062cd675170ceb54d90da22fe7e668 (patch)
tree7da3aefc858b300568bd020bced73173248f183c /include/linux
parent0955c774f32d15d39d29548273cccd39bbc9ec23 (diff)
net/mlx5: Avoid possible free of command entry while timeout comp handler
[ Upstream commit 50b2412b7e7862c5af0cbf4b10d93bc5c712d021 ] Upon command completion timeout, driver simulates a forced command completion. In a rare case where real interrupt for that command arrives simultaneously, it might release the command entry while the forced handler might still access it. Fix that by adding an entry refcount, to track current amount of allowed handlers. Command entry to be released only when this refcount is decremented to zero. Command refcount is always initialized to one. For callback commands, command completion handler is the symmetric flow to decrement it. For non-callback commands, it is wait_func(). Before ringing the doorbell, increment the refcount for the real completion handler. Once the real completion handler is called, it will decrement it. For callback commands, once the delayed work is scheduled, increment the refcount. Upon callback command completion handler, we will try to cancel the timeout callback. In case of success, we need to decrement the callback refcount as it will never run. In addition, gather the entry index free and the entry free into a one flow for all command types release. Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com> Reviewed-by: Moshe Shemesh <moshe@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/linux')
-rw-r--r--include/linux/mlx5/driver.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 897829651204..6b4f86dfca38 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -769,6 +769,8 @@ struct mlx5_cmd_work_ent {
u64 ts2;
u16 op;
bool polling;
+ /* Track the max comp handlers */
+ refcount_t refcnt;
};
struct mlx5_pas {