| Message ID | 4069b99042d28c8e51b941d9e698b99d1656ed33.1649310812.git.duoming@zju.edu.cn |
|---|---|
| State | New |
| Headers | show |
| Series | Fix deadlocks caused by del_timer_sync() | expand |
diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c index dedb3b7edd8..019dd8bfe08 100644 --- a/drivers/infiniband/hw/irdma/cm.c +++ b/drivers/infiniband/hw/irdma/cm.c @@ -3252,8 +3252,11 @@ void irdma_cleanup_cm_core(struct irdma_cm_core *cm_core) return; spin_lock_irqsave(&cm_core->ht_lock, flags); - if (timer_pending(&cm_core->tcp_timer)) + if (timer_pending(&cm_core->tcp_timer)) { + spin_unlock_irqrestore(&cm_core->ht_lock, flags); del_timer_sync(&cm_core->tcp_timer); + spin_lock_irqsave(&cm_core->ht_lock, flags); + } spin_unlock_irqrestore(&cm_core->ht_lock, flags); destroy_workqueue(cm_core->event_wq);
There is a deadlock in irdma_cleanup_cm_core(), which is shown below: (Thread 1) | (Thread 2) | irdma_schedule_cm_timer() irdma_cleanup_cm_core() | add_timer() spin_lock_irqsave() //(1) | (wait a time) ... | irdma_cm_timer_tick() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold cm_core->ht_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need cm_core->ht_lock in position (2) of thread 2. As a result, irdma_cleanup_cm_core() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/infiniband/hw/irdma/cm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)