From owner-svn-src-head@freebsd.org Wed Mar 15 19:10:05 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E5344D0E621; Wed, 15 Mar 2017 19:10:05 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B21C91BF5; Wed, 15 Mar 2017 19:10:05 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v2FJA4Si000166; Wed, 15 Mar 2017 19:10:04 GMT (envelope-from np@FreeBSD.org) Received: (from np@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v2FJA4LZ000165; Wed, 15 Mar 2017 19:10:04 GMT (envelope-from np@FreeBSD.org) Message-Id: <201703151910.v2FJA4LZ000165@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: np set sender to np@FreeBSD.org using -f From: Navdeep Parhar Date: Wed, 15 Mar 2017 19:10:04 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r315325 - head/sys/dev/cxgbe/iw_cxgbe X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 19:10:06 -0000 Author: np Date: Wed Mar 15 19:10:04 2017 New Revision: 315325 URL: https://svnweb.freebsd.org/changeset/base/315325 Log: cxgbe/iw_cxgbe: Use the socket and not the toepcb to reach for the inpcb. t4_tom detaches the inpcb from the toepcb as soon as the hardware is done with the connection (in final_cpl_received) but the socket is around as long as the cm_id and the rest of iWARP state is. This fixes an intermittent NULL dereference during abort. Submitted by: KrishnamRaju ErapaRaju @ Chelsio MFC after: 3 days Sponsored by: Chelsio Communications Modified: head/sys/dev/cxgbe/iw_cxgbe/qp.c Modified: head/sys/dev/cxgbe/iw_cxgbe/qp.c ============================================================================== --- head/sys/dev/cxgbe/iw_cxgbe/qp.c Wed Mar 15 18:57:18 2017 (r315324) +++ head/sys/dev/cxgbe/iw_cxgbe/qp.c Wed Mar 15 19:10:04 2017 (r315325) @@ -64,7 +64,7 @@ struct cpl_set_tcb_rpl; #include "iw_cxgbe.h" #include "user.h" -static void creds(struct toepcb *toep, size_t wrsize); +static int creds(struct toepcb *toep, struct inpcb *inp, size_t wrsize); static void set_state(struct c4iw_qp *qhp, enum c4iw_qp_state state) @@ -961,6 +961,7 @@ static inline void build_term_codes(stru static void post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe, gfp_t gfp) { + int ret; struct fw_ri_wr *wqe; struct terminate_message *term; struct wrqe *wr; @@ -991,7 +992,11 @@ static void post_terminate(struct c4iw_q term->ecode = qhp->attr.ecode; } else build_term_codes(err_cqe, &term->layer_etype, &term->ecode); - creds(toep, sizeof(*wqe)); + ret = creds(toep, inp, sizeof(*wqe)); + if (ret) { + free_wrqe(wr); + return; + } t4_wrq_tx(qhp->rhp->rdev.adap, wr); } @@ -1094,7 +1099,11 @@ rdma_fini(struct c4iw_dev *rhp, struct c c4iw_init_wr_wait(&ep->com.wr_wait); - creds(toep, sizeof(*wqe)); + ret = creds(toep, inp, sizeof(*wqe)); + if (ret) { + free_wrqe(wr); + return ret; + } t4_wrq_tx(sc, wr); ret = c4iw_wait_for_reply(rdev, &ep->com.wr_wait, ep->hwtid, @@ -1127,13 +1136,17 @@ static void build_rtr_msg(u8 p2p_type, s } } -static void -creds(struct toepcb *toep, size_t wrsize) +static int +creds(struct toepcb *toep, struct inpcb *inp, size_t wrsize) { struct ofld_tx_sdesc *txsd; CTR3(KTR_IW_CXGBE, "%s:creB %p %u", __func__, toep , wrsize); - INP_WLOCK(toep->inp); + INP_WLOCK(inp); + if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) != 0) { + INP_WUNLOCK(inp); + return (EINVAL); + } txsd = &toep->txsd[toep->txsd_pidx]; txsd->tx_credits = howmany(wrsize, 16); txsd->plen = 0; @@ -1143,9 +1156,10 @@ creds(struct toepcb *toep, size_t wrsize if (__predict_false(++toep->txsd_pidx == toep->txsd_total)) toep->txsd_pidx = 0; toep->txsd_avail--; - INP_WUNLOCK(toep->inp); + INP_WUNLOCK(inp); CTR5(KTR_IW_CXGBE, "%s:creE %p %u %u %u", __func__, toep , txsd->tx_credits, toep->tx_credits, toep->txsd_pidx); + return (0); } static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp) @@ -1216,7 +1230,11 @@ static int rdma_init(struct c4iw_dev *rh c4iw_init_wr_wait(&ep->com.wr_wait); - creds(toep, sizeof(*wqe)); + ret = creds(toep, inp, sizeof(*wqe)); + if (ret) { + free_wrqe(wr); + return ret; + } t4_wrq_tx(sc, wr); ret = c4iw_wait_for_reply(rdev, &ep->com.wr_wait, ep->hwtid,