[patch 16/32] IB/ucm: Fix deadlock in cleanup

Chris Wright
2006-12-09T00:06:45Z

[-- Attachment #1: ib-ucm-fix-deadlock-in-cleanup.patch --]
[-- Type: text/plain, Size: 1408 bytes --]

-stable review patch. If anyone has any objections, please let us know.
------------------

From: Michael S Tsirkin <mst@mellanox.co.il>

ib_ucm_cleanup_events() holds file_mutex while calling ib_destroy_cm_id().
This can deadlock since ib_destroy_cm_id() flushes event handlers, and
ib_ucm_event_handler() needs file_mutex, too. Therefore, drop the
file_mutex during the call to ib_destroy_cm_id().

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

Hello, -stable team!
This patch backports commit f469b2626f48829c06e40ac799c1edf62b12048e to 2.6.19.
Please consider it for 2.6.19.y - this fixes a deadlock reproduced here at Mellanox.

drivers/infiniband/core/ucm.c | 2 ++
1 file changed, 2 insertions(+)

--- linux-2.6.19.orig/drivers/infiniband/core/ucm.c
+++ linux-2.6.19/drivers/infiniband/core/ucm.c
@@ -161,12 +161,14 @@ static void ib_ucm_cleanup_events(struct
struct ib_ucm_event, ctx_list);
list_del(&uevent->file_list);
list_del(&uevent->ctx_list);
+ mutex_unlock(&ctx->file->file_mutex);

/* clear incoming connections. */
if (ib_ucm_new_cm_id(uevent->resp.event))
ib_destroy_cm_id(uevent->cm_id);

kfree(uevent);
+ mutex_lock(&ctx->file->file_mutex);
}
mutex_unlock(&ctx->file->file_mutex);
}

--