IB: refcount race fixes
authorSean Hefty <mshefty@ichips.intel.com>
Fri, 12 May 2006 21:57:52 +0000 (14:57 -0700)
committerRoland Dreier <rolandd@cisco.com>
Fri, 12 May 2006 21:57:52 +0000 (14:57 -0700)
commit1b52fa98edd1c3e663ea4a06519e3d20976084a8
tree178d5fd1fe2230b39f49cd36f481024e49878eb1
parent6f4bb3d8205d943acafa2f536f37131777524b67
IB: refcount race fixes

Fix race condition during destruction calls to avoid possibility of
accessing object after it has been freed.  Instead of waking up a wait
queue directly, which is susceptible to a race where the object is
freed between the reference count going to 0 and the wake_up(), use a
completion to wait in the function doing the freeing.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/core/cm.c
drivers/infiniband/core/mad.c
drivers/infiniband/core/mad_priv.h
drivers/infiniband/core/mad_rmpp.c
drivers/infiniband/core/ucm.c