• Shlomo Pongratz's avatar
    IPoIB: Fix crash due to skb double destruct · 7e5a90c2
    Shlomo Pongratz authored
    After commit b13912bb ("IPoIB: Call skb_dst_drop() once skb is
    enqueued for sending"), using connected mode and running multithreaded
    iperf for long time, ie
    
        iperf -c <IP> -P 16 -t 3600
    
    results in a crash.
    
    After the above-mentioned patch, the driver is calling skb_orphan() and
    skb_dst_drop() after calling post_send() in ipoib_cm.c::ipoib_cm_send()
    (also in ipoib_ib.c::ipoib_send())
    
    The problem with this is, as is written in a comment in both routines,
    "it's entirely possible that the completion handler will run before we
    execute anything after the post_send()."  This leads to running the
    skb cleanup routines simultaneously in two different contexts.
    
    The solution is to always perform the skb_orphan() and skb_dst_drop()
    before queueing the send work request.  If an error occurs, then it
    will be no different than the regular case where dev_free_skb_any() in
    the completion path, which is assumed to be after these two routines.
    Signed-off-by: default avatarShlomo Pongratz <shlomop@mellanox.com>
    Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
    7e5a90c2
ipoib_ib.c 27.4 KB