d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iw_cxgbe: Fix panic that occurs when c4iw_ev_handler tries to acquire

Browse Source 
comp_handler_lock but c4iw_destroy_cq has already freed the CQ memory
(which is where the lock resides).

Submitted by:	Krishnamraju Eraparaju @ Chelsio
Sponsored by:	Chelsio Communications
This commit is contained in:
Navdeep Parhar 2016-06-01 18:46:54 +00:00
parent fc4f686d59
commit e6b775f48f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=301158
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/dev/cxgbe/iw_cxgbe/ev.c
View File

@ -194,13 +194,22 @@ int c4iw_ev_handler(struct sge_iq *iq, const struct rsp_ctrl *rc)
struct c4iw_cq *chp;
unsigned long flag;
spin_lock_irqsave(&dev->lock, flag);
chp = get_chp(dev, qid);
if (chp) {
atomic_inc(&chp->refcnt);
spin_unlock_irqrestore(&dev->lock, flag);
spin_lock_irqsave(&chp->comp_handler_lock, flag);
(*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
spin_unlock_irqrestore(&chp->comp_handler_lock, flag);
} else
if (atomic_dec_and_test(&chp->refcnt))
wake_up(&chp->wait);
} else {
CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid);
spin_unlock_irqrestore(&dev->lock, flag);
}
return 0;
}
#endif