Commit af6565ad authored by Michal Kalderon's avatar Michal Kalderon Committed by David S. Miller

qede: Fix race between rdma destroy workqueue and link change event

If an event is added while the rdma workqueue is being destroyed
it could lead to several races, list corruption, null pointer
dereference during queue_work or init_queue.
This fixes the race between the two flows which can occur during
shutdown.

A kref object and a completion object are added to the rdma_dev
structure, these are initialized before the workqueue is created.
The refcnt is used to indicate work is being added to the
workqueue and ensures the cleanup flow won't start while we're in
the middle of adding the event.
Once the work is added, the refcnt is decreased and the cleanup flow
is safe to run.

Fixes: cee9fbd8 ("qede: Add qedr framework")
Signed-off-by: default avatarAriel Elior <ariel.elior@marvell.com>
Signed-off-by: default avatarMichal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9b64208f
...@@ -163,6 +163,8 @@ struct qede_rdma_dev { ...@@ -163,6 +163,8 @@ struct qede_rdma_dev {
struct list_head entry; struct list_head entry;
struct list_head rdma_event_list; struct list_head rdma_event_list;
struct workqueue_struct *rdma_wq; struct workqueue_struct *rdma_wq;
struct kref refcnt;
struct completion event_comp;
bool exp_recovery; bool exp_recovery;
}; };
......
...@@ -59,6 +59,9 @@ static void _qede_rdma_dev_add(struct qede_dev *edev) ...@@ -59,6 +59,9 @@ static void _qede_rdma_dev_add(struct qede_dev *edev)
static int qede_rdma_create_wq(struct qede_dev *edev) static int qede_rdma_create_wq(struct qede_dev *edev)
{ {
INIT_LIST_HEAD(&edev->rdma_info.rdma_event_list); INIT_LIST_HEAD(&edev->rdma_info.rdma_event_list);
kref_init(&edev->rdma_info.refcnt);
init_completion(&edev->rdma_info.event_comp);
edev->rdma_info.rdma_wq = create_singlethread_workqueue("rdma_wq"); edev->rdma_info.rdma_wq = create_singlethread_workqueue("rdma_wq");
if (!edev->rdma_info.rdma_wq) { if (!edev->rdma_info.rdma_wq) {
DP_NOTICE(edev, "qedr: Could not create workqueue\n"); DP_NOTICE(edev, "qedr: Could not create workqueue\n");
...@@ -83,8 +86,23 @@ static void qede_rdma_cleanup_event(struct qede_dev *edev) ...@@ -83,8 +86,23 @@ static void qede_rdma_cleanup_event(struct qede_dev *edev)
} }
} }
static void qede_rdma_complete_event(struct kref *ref)
{
struct qede_rdma_dev *rdma_dev =
container_of(ref, struct qede_rdma_dev, refcnt);
/* no more events will be added after this */
complete(&rdma_dev->event_comp);
}
static void qede_rdma_destroy_wq(struct qede_dev *edev) static void qede_rdma_destroy_wq(struct qede_dev *edev)
{ {
/* Avoid race with add_event flow, make sure it finishes before
* we start accessing the list and cleaning up the work
*/
kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event);
wait_for_completion(&edev->rdma_info.event_comp);
qede_rdma_cleanup_event(edev); qede_rdma_cleanup_event(edev);
destroy_workqueue(edev->rdma_info.rdma_wq); destroy_workqueue(edev->rdma_info.rdma_wq);
} }
...@@ -310,15 +328,24 @@ static void qede_rdma_add_event(struct qede_dev *edev, ...@@ -310,15 +328,24 @@ static void qede_rdma_add_event(struct qede_dev *edev,
if (!edev->rdma_info.qedr_dev) if (!edev->rdma_info.qedr_dev)
return; return;
/* We don't want the cleanup flow to start while we're allocating and
* scheduling the work
*/
if (!kref_get_unless_zero(&edev->rdma_info.refcnt))
return; /* already being destroyed */
event_node = qede_rdma_get_free_event_node(edev); event_node = qede_rdma_get_free_event_node(edev);
if (!event_node) if (!event_node)
return; goto out;
event_node->event = event; event_node->event = event;
event_node->ptr = edev; event_node->ptr = edev;
INIT_WORK(&event_node->work, qede_rdma_handle_event); INIT_WORK(&event_node->work, qede_rdma_handle_event);
queue_work(edev->rdma_info.rdma_wq, &event_node->work); queue_work(edev->rdma_info.rdma_wq, &event_node->work);
out:
kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event);
} }
void qede_rdma_dev_event_open(struct qede_dev *edev) void qede_rdma_dev_event_open(struct qede_dev *edev)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment