Commit 6a0c435e authored by Hal Rosenstock's avatar Hal Rosenstock Committed by Linus Torvalds
Browse files

[PATCH] IB: Fix timeout/cancelled MAD handling

Fixes an issue processing a sent MAD after it has timed out or been canceled.
The race occurs when a response MAD matches with the send request.  The
request could time out or be canceled after the response MAD matches with the
request, but before the request completion can be processed.

Signed-off-by: default avatarSean Hefty <>
Signed-off-by: default avatarHal Rosenstock <>
Cc: Roland Dreier <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent d760ce8f
......@@ -341,6 +341,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
INIT_WORK(&mad_agent_priv->timed_work, timeout_sends, mad_agent_priv);
INIT_WORK(&mad_agent_priv->local_work, local_completions,
......@@ -1559,6 +1560,16 @@ find_send_req(struct ib_mad_agent_private *mad_agent_priv,
return NULL;
static void ib_mark_req_done(struct ib_mad_send_wr_private *mad_send_wr)
mad_send_wr->timeout = 0;
if (mad_send_wr->refcount == 1) {
static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
struct ib_mad_recv_wc *mad_recv_wc)
......@@ -1580,8 +1591,7 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
/* Timeout = 0 means that we won't wait for a response */
mad_send_wr->timeout = 0;
spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
/* Defined behavior is to complete response before request */
......@@ -92,6 +92,7 @@ struct ib_mad_agent_private {
spinlock_t lock;
struct list_head send_list;
struct list_head wait_list;
struct list_head done_list;
struct work_struct timed_work;
unsigned long timeout;
struct list_head local_list;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment