IB/ipoib: Fix packet loss after hardware address update
authorMichael S. Tsirkin <mst@mellanox.co.il>
Wed, 19 Jul 2006 14:44:37 +0000 (17:44 +0300)
committerRoland Dreier <rolandd@cisco.com>
Mon, 24 Jul 2006 16:18:07 +0000 (09:18 -0700)
The neighbour ha field may get updated without destroying the
neighbour.  In this case, the ha field gets out of sync with the
address handle stored in ipoib_neigh->ah, with the result that
the ah field would point to an incorrect path, resulting in all
packets being lost.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/ulp/ipoib/ipoib.h
drivers/infiniband/ulp/ipoib/ipoib_main.c

index 3f89f5e190367ce6d82f6930d2372bd94bb8955c..474aa214ab57ed923b16b4376979ca5b63d28249 100644 (file)
@@ -212,6 +212,7 @@ struct ipoib_path {
 
 struct ipoib_neigh {
        struct ipoib_ah    *ah;
+       union ib_gid        dgid;
        struct sk_buff_head queue;
 
        struct neighbour   *neighbour;
index 1c6ea1c682a5dc7c4bd5bed14f67307ef27aa1a1..cf71d2a5515c1d734026827355680847a6a51893 100644 (file)
@@ -404,6 +404,8 @@ static void path_rec_completion(int status,
                list_for_each_entry(neigh, &path->neigh_list, list) {
                        kref_get(&path->ah->ref);
                        neigh->ah = path->ah;
+                       memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                              sizeof(union ib_gid));
 
                        while ((skb = __skb_dequeue(&neigh->queue)))
                                __skb_queue_tail(&skqueue, skb);
@@ -510,6 +512,8 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
        if (path->ah) {
                kref_get(&path->ah->ref);
                neigh->ah = path->ah;
+               memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
+                      sizeof(union ib_gid));
 
                ipoib_send(dev, skb, path->ah,
                           be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
@@ -633,6 +637,25 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                neigh = *to_ipoib_neigh(skb->dst->neighbour);
 
                if (likely(neigh->ah)) {
+                       if (unlikely(memcmp(&neigh->dgid.raw,
+                                           skb->dst->neighbour->ha + 4,
+                                           sizeof(union ib_gid)))) {
+                               spin_lock(&priv->lock);
+                               /*
+                                * It's safe to call ipoib_put_ah() inside
+                                * priv->lock here, because we know that
+                                * path->ah will always hold one more reference,
+                                * so ipoib_put_ah() will never do more than
+                                * decrement the ref count.
+                                */
+                               ipoib_put_ah(neigh->ah);
+                               list_del(&neigh->list);
+                               ipoib_neigh_free(neigh);
+                               spin_unlock(&priv->lock);
+                               ipoib_path_lookup(skb, dev);
+                               goto out;
+                       }
+
                        ipoib_send(dev, skb, neigh->ah,
                                   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
                        goto out;