瀏覽代碼

Merge branch 'mellanox'

Eli Cohen says:

====================
irq sync fixes

This two patch series fixes a race where an interrupt handler could access a
freed memory.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller 10 年之前
父節點
當前提交
aa9c557915
共有 2 個文件被更改,包括 2 次插入0 次删除
  1. 1 0
      drivers/net/ethernet/mellanox/mlx4/eq.c
  2. 1 0
      drivers/net/ethernet/mellanox/mlx5/core/eq.c

+ 1 - 0
drivers/net/ethernet/mellanox/mlx4/eq.c

@@ -1026,6 +1026,7 @@ static void mlx4_free_eq(struct mlx4_dev *dev,
 				pr_cont("\n");
 				pr_cont("\n");
 		}
 		}
 	}
 	}
+	synchronize_irq(eq->irq);
 
 
 	mlx4_mtt_cleanup(dev, &eq->mtt);
 	mlx4_mtt_cleanup(dev, &eq->mtt);
 	for (i = 0; i < npages; ++i)
 	for (i = 0; i < npages; ++i)

+ 1 - 0
drivers/net/ethernet/mellanox/mlx5/core/eq.c

@@ -420,6 +420,7 @@ int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
 	if (err)
 	if (err)
 		mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n",
 		mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n",
 			       eq->eqn);
 			       eq->eqn);
+	synchronize_irq(table->msix_arr[eq->irqn].vector);
 	mlx5_buf_free(dev, &eq->buf);
 	mlx5_buf_free(dev, &eq->buf);
 
 
 	return err;
 	return err;