d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iw_cxgbe: Fix panic that occurs when c4iw_ev_handler tries to acquire

Browse Source 
comp_handler_lock but c4iw_destroy_cq has already freed the CQ memory
(which is where the lock resides).

Submitted by:	Krishnamraju Eraparaju @ Chelsio
Sponsored by:	Chelsio Communications
This commit is contained in:
Navdeep Parhar 2016-06-01 18:46:54 +00:00
parent fc4f686d59
commit e6b775f48f
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/dev/cxgbe/iw_cxgbe/ev.c
View File

@ -194,13 +194,22 @@ int c4iw_ev_handler(struct sge_iq *iq, const struct rsp_ctrl *rc)
struct c4iw_cq *chp; struct c4iw_cq *chp;
unsigned long flag; unsigned long flag;
spin_lock_irqsave(&dev->lock, flag);
chp = get_chp(dev, qid); chp = get_chp(dev, qid);
if (chp) { if (chp) {
atomic_inc(&chp->refcnt);
spin_unlock_irqrestore(&dev->lock, flag);
spin_lock_irqsave(&chp->comp_handler_lock, flag); spin_lock_irqsave(&chp->comp_handler_lock, flag);
(*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context); (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
spin_unlock_irqrestore(&chp->comp_handler_lock, flag); spin_unlock_irqrestore(&chp->comp_handler_lock, flag);
} else if (atomic_dec_and_test(&chp->refcnt))
wake_up(&chp->wait);
} else {
CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid); CTR2(KTR_IW_CXGBE, "%s unknown cqid 0x%x", __func__, qid);
spin_unlock_irqrestore(&dev->lock, flag);
}
return 0; return 0;
} }
#endif #endif