From: Mitko Haralanov Date: Wed, 3 Feb 2016 22:37:41 +0000 (-0800) Subject: staging/rdma/hfi1: Fix bug that could block the process on context exit X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=a402d6ab409e0e943150a803b94dee76c9de5c27;p=linux-beck.git staging/rdma/hfi1: Fix bug that could block the process on context exit A race was discovred in the user SDMA code, which could result in an process being stuck in the kernel call indefinitely in certain error conditions. If, during the processing of a user SDMA request, there was an error *and* all outstanding SDMA descriptor had been completed by the time the that error case was handled in the calling function, the state of the packet queue would not get correctly updated resulting in the process subsequently getting stuck, thinking that there are more descriptors to be completed. To handle this scenario, the driver now checks the submitted packet count vs. the completed. If all submitted packets have also been completed, the driver can safely free the request and signal user level. Otherwise, this will be handled by the completion callback. Reviewed-by: Dennis Dalessandro Signed-off-by: Mitko Haralanov Signed-off-by: Jubin John Signed-off-by: Doug Ledford --- diff --git a/drivers/staging/rdma/hfi1/user_sdma.c b/drivers/staging/rdma/hfi1/user_sdma.c index 55c7e6a4eb1a..ac903099843e 100644 --- a/drivers/staging/rdma/hfi1/user_sdma.c +++ b/drivers/staging/rdma/hfi1/user_sdma.c @@ -678,7 +678,6 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, ret = user_sdma_send_pkts(req, pcount); if (unlikely(ret < 0 && ret != -EBUSY)) { req->status = ret; - atomic_dec(&pq->n_reqs); goto free_req; } @@ -703,6 +702,9 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, if (ret != -EBUSY) { req->status = ret; set_bit(SDMA_REQ_DONE_ERROR, &req->flags); + if (ACCESS_ONCE(req->seqcomp) == + req->seqsubmitted - 1) + goto free_req; return ret; } wait_event_interruptible_timeout( @@ -717,6 +719,7 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, return 0; free_req: user_sdma_free_request(req, true); + pq_update(pq); set_comp_state(pq, cq, info.comp_idx, ERROR, req->status); return ret; }