LU-14733 o2iblnd: Move racy NULL assignment From: Mike Marciniszyn kiblnd_fmr_pool_unmap() can race map and subsequent processing because of this flaw in unmap: if (frd) { frd->frd_valid = false; spin_lock(&fps->fps_lock); list_add_tail(&frd->frd_list, &fpo->fast_reg.fpo_pool_list); spin_unlock(&fps->fps_lock); fmr->fmr_frd = NULL; } The fmr can be pulled off the list in kiblnd_fmr_pool_unmap() on another CPU an fmr_frd could be in a state of flux and potentially be seen incorrectly later on as the kib_tx is processed. Fix my moving the fmr_frd assignment to before the fmr is added to the list. Signed-off-by: Mike Marciniszyn Change-Id: Ibddf132a363ecfe9db3cc06287cec873c021d2fb --- lnet/klnds/o2iblnd/o2iblnd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lnet/klnds/o2iblnd/o2iblnd.c b/lnet/klnds/o2iblnd/o2iblnd.c index b28c5b2..f3028b4 100644 --- a/lnet/klnds/o2iblnd/o2iblnd.c +++ b/lnet/klnds/o2iblnd/o2iblnd.c @@ -1751,10 +1751,10 @@ kiblnd_fmr_pool_unmap(struct kib_fmr *fmr, int status) if (frd) { frd->frd_valid = false; + fmr->fmr_frd = NULL; spin_lock(&fps->fps_lock); list_add_tail(&frd->frd_list, &fpo->fast_reg.fpo_pool_list); spin_unlock(&fps->fps_lock); - fmr->fmr_frd = NULL; } } fmr->fmr_pool = NULL;