IB/core: Add locking around event dispatching on XRC target QPs

Fix a potential race when event occurrs on a target XRC QP and in the
middle of reporting that on its shared qps, one of them is destroyed
by user space application.  Also add note for kernel consumers in
ib_verbs.h that they must not destroy the QP from within the handler.

Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 22192deb88282b51f195521e6468840655bb219e..077fd641b30006e82fb1f425975d35c0968a6c59 100644 (file)
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -346,10 +346,13 @@ EXPORT_SYMBOL(ib_destroy_srq);
 static void __ib_shared_qp_event_handler(struct ib_event *event, void *context)
 {
        struct ib_qp *qp = context;
+       unsigned long flags;
 
+       spin_lock_irqsave(&qp->device->event_handler_lock, flags);
        list_for_each_entry(event->element.qp, &qp->open_list, open_list)
                if (event->element.qp->event_handler)
                        event->element.qp->event_handler(event, event->element.qp->qp_context);
+       spin_unlock_irqrestore(&qp->device->event_handler_lock, flags);
 }
 
 static void __ib_insert_xrcd_qp(struct ib_xrcd *xrcd, struct ib_qp *qp)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 645c3cedce9ca7abb69c13769a05aff02d4b5dd4..a84d3dfc40765f7ac688bb3e1932e4aa89e544a7 100644 (file)
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -635,6 +635,12 @@ enum ib_qp_create_flags {
        IB_QP_CREATE_RESERVED_END               = 1 << 31,
 };
 
+
+/*
+ * Note: users may not call ib_close_qp or ib_destroy_qp from the event_handler
+ * callback to destroy the passed in QP.
+ */
+
 struct ib_qp_init_attr {
        void                  (*event_handler)(struct ib_event *, void *);
        void                   *qp_context;