Date: Wed, 1 Jun 2016 18:46:54 +0000 (UTC) From: Navdeep Parhar <np@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r301158 - head/sys/dev/cxgbe/iw_cxgbe Message-ID: <201606011846.u51IksQT082633@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: np Date: Wed Jun 1 18:46:54 2016 New Revision: 301158 URL: https://svnweb.freebsd.org/changeset/base/301158 Log: iw_cxgbe: Fix panic that occurs when c4iw_ev_handler tries to acquire comp_handler_lock but c4iw_destroy_cq has already freed the CQ memory (which is where the lock resides). Submitted by: Krishnamraju Eraparaju @ Chelsio Sponsored by: Chelsio Communications Modified: head/sys/dev/cxgbe/iw_cxgbe/ev.c Modified: head/sys/dev/cxgbe/iw_cxgbe/ev.c ============================================================================== --- head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:32:20 2016 (r301157) +++ head/sys/dev/cxgbe/iw_cxgbe/ev.c Wed Jun 1 18:46:54 2016 (r301158) @@ -194,13 +194,22 @@ int c4iw_ev_handler(struct sge_iq *iq, c struct c4iw_cq *chp; unsigned long flag; + spin_lock_irqsave(&dev->lock, flag); chp = get_chp(dev, qid); if (chp) { + atomic_inc(&chp->refcnt); + spin_unlock_irqrestore(&dev->lock, flag); + spin_lock_irqsave(&chp->comp_handler_lock, flag); (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context); spin_unlock_irqrestore(&chp->comp_handler_lock, flag); - } else + if (atomic_dec_and_test(&chp->refcnt)) + wake_up(&chp->wait); + } else { CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid); + spin_unlock_irqrestore(&dev->lock, flag); + } + return 0; } #endif
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201606011846.u51IksQT082633>