[PATCH 1/1] IB/sa: Fix sa_local_svc_timeout_ms read race

[PATCH 1/1] IB/sa: Fix sa_local_svc_timeout_ms read race

[Edward Srouji]

From: Vlad Dumitrescu <vdumitrescu@nvidia.com>

When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
Reviewed-by: Mark Zhang <markzhang@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
 drivers/infiniband/core/sa_query.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index c0a7af1b4fe4..c23e9c847314 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1074,6 +1074,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 	if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
 		timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
 
+	spin_lock_irqsave(&ib_nl_request_lock, flags);
+
 	delta = timeout - sa_local_svc_timeout_ms;
 	if (delta < 0)
 		abs_delta = -delta;
@@ -1081,7 +1083,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		abs_delta = delta;
 
 	if (delta != 0) {
-		spin_lock_irqsave(&ib_nl_request_lock, flags);
 		sa_local_svc_timeout_ms = timeout;
 		list_for_each_entry(query, &ib_nl_request_list, list) {
 			if (delta < 0 && abs_delta > query->timeout)
@@ -1099,9 +1100,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		if (delay)
 			mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
 					 (unsigned long)delay);
-		spin_unlock_irqrestore(&ib_nl_request_lock, flags);
 	}
 
+	spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
 settimeout_out:
 	return 0;
 }
-- 
2.21.3

Re: [PATCH 1/1] IB/sa: Fix sa_local_svc_timeout_ms read race

[Leon Romanovsky]

On Tue, 16 Sep 2025 19:31:12 +0300, Edward Srouji wrote:
> When computing the delta, the sa_local_svc_timeout_ms is read without
> ib_nl_request_lock held. Though unlikely in practice, this can cause
> a race condition if multiple local service threads are managing the
> timeout.
> 
> 

Applied, thanks!

[1/1] IB/sa: Fix sa_local_svc_timeout_ms read race
      https://git.kernel.org/rdma/rdma/c/1428cd764cd708

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>