diff options
| author | Sean Hefty <mshefty@ichips.intel.com> | 2006-05-12 14:57:52 -0700 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2006-05-12 14:57:52 -0700 |
| commit | 1b52fa98edd1c3e663ea4a06519e3d20976084a8 (patch) | |
| tree | 178d5fd1fe2230b39f49cd36f481024e49878eb1 /drivers/infiniband/core/mad_priv.h | |
| parent | 6f4bb3d8205d943acafa2f536f37131777524b67 (diff) | |
| download | linux-1b52fa98edd1c3e663ea4a06519e3d20976084a8.tar.gz linux-1b52fa98edd1c3e663ea4a06519e3d20976084a8.tar.bz2 linux-1b52fa98edd1c3e663ea4a06519e3d20976084a8.zip | |
IB: refcount race fixes
Fix race condition during destruction calls to avoid possibility of
accessing object after it has been freed. Instead of waking up a wait
queue directly, which is susceptible to a race where the object is
freed between the reference count going to 0 and the wake_up(), use a
completion to wait in the function doing the freeing.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/core/mad_priv.h')
| -rw-r--r-- | drivers/infiniband/core/mad_priv.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h index 6c9c133d71ef..b4fa28d3160f 100644 --- a/drivers/infiniband/core/mad_priv.h +++ b/drivers/infiniband/core/mad_priv.h @@ -37,6 +37,7 @@ #ifndef __IB_MAD_PRIV_H__ #define __IB_MAD_PRIV_H__ +#include <linux/completion.h> #include <linux/pci.h> #include <linux/kthread.h> #include <linux/workqueue.h> @@ -108,7 +109,7 @@ struct ib_mad_agent_private { struct list_head rmpp_list; atomic_t refcount; - wait_queue_head_t wait; + struct completion comp; }; struct ib_mad_snoop_private { @@ -117,7 +118,7 @@ struct ib_mad_snoop_private { int snoop_index; int mad_snoop_flags; atomic_t refcount; - wait_queue_head_t wait; + struct completion comp; }; struct ib_mad_send_wr_private { |