Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754862AbbKRH7W (ORCPT ); Wed, 18 Nov 2015 02:59:22 -0500 Received: from mail-wm0-f52.google.com ([74.125.82.52]:34526 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752634AbbKRH7U (ORCPT ); Wed, 18 Nov 2015 02:59:20 -0500 Subject: Re: [PATCH 3/9] IB: add a helper to safely drain a QP To: Bart Van Assche , Christoph Hellwig , linux-rdma@vger.kernel.org References: <1447422410-20891-1-git-send-email-hch@lst.de> <1447422410-20891-4-git-send-email-hch@lst.de> <564851BB.1020004@dev.mellanox.co.il> <564B5E7D.9030309@sandisk.com> Cc: axboe@fb.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org From: Sagi Grimberg Message-ID: <564C2FD3.6090608@dev.mellanox.co.il> Date: Wed, 18 Nov 2015 09:59:15 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <564B5E7D.9030309@sandisk.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1571 Lines: 38 On 17/11/2015 19:06, Bart Van Assche wrote: > On 11/15/2015 01:34 AM, Sagi Grimberg wrote: >> This is taken from srp, and srp drains using a recv wr due to a race >> causing a use-after-free condition in srp which re-posts a recv buffer >> in the recv completion handler. > > Hello Sagi, > > Would it be possible to clarify this ? Does this refer to an existing > race or a race that would only occur if the code would be modified ? I was referring to a bug that srp_destroy_qp() was design to address: commit 7dad6b2e440d810273946b0e7092a8fe043c3b8a Author: Bart Van Assche Date: Tue Oct 21 18:00:35 2014 +0200 IB/srp: Fix a race condition triggered by destroying a queue pair At least LID reassignment can trigger a race condition in the SRP initiator driver, namely the receive completion handler trying to post a request on a QP during or after QP destruction and before the CQ's have been destroyed. Avoid this race by modifying a QP into the error state and by waiting until all receive completions have been processed before destroying a QP. Reported-by: Max Gurtuvoy Signed-off-by: Bart Van Assche Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/