diff options
| author |   Andrew Boyer <andrew.boyer@dell.com> | 2016-12-05 08:43:20 -0500 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2016-12-12 16:31:45 -0500 |
| commit | 07bf9627d5f1c0334fc543a5435a31a3b5907944 (patch) | |
| tree | 92998cf99b917960295d2c9e1aa9be7cc9bb6b50 /drivers/infiniband/sw/rxe/rxe_req.c | |
| parent | IB/rxe: Fix ref leak in duplicate_request() (diff) | |
| download | linux-dev-07bf9627d5f1c0334fc543a5435a31a3b5907944.tar.xz linux-dev-07bf9627d5f1c0334fc543a5435a31a3b5907944.zip | |
IB/rxe: Wait for tasklets to finish before tearing down QP
The system may crash when a malformed request is received and
the error is detected by the responder.
NodeA: $ ibv_rc_pingpong -g 0 -d rxe0 -i 1 -n 1 -s 50000
NodeB: $ ibv_rc_pingpong -g 0 -d rxe0 -i 1 -n 1 -s 1024 <NodeA_ip>
The responder generates a receive error on node B since the incoming
SEND is oversized. If the client tears down the QP before the responder
or the completer finish running, a page fault may occur.
The fix makes the destroy operation spin until the tasks complete, which
appears to be original intent of the design.
Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_req.c')
0 files changed, 0 insertions, 0 deletions