From d916a8f1b43b358685b1672390ead11f2d3b74c6 Mon Sep 17 00:00:00 2001 From: Ishai Rabinovitz <ishai@mellanox.co.il> Date: Tue, 25 Jul 2006 19:54:09 +0300 Subject: [PATCH] IB/srp: Fix crash in srp_reconnect_target Protect against srp_reset_device() clearing the req_queue while srp_reconnect_target() is in progress (note that state change at the top of srp_reconnect_target() is not sufficient for this since srp_reset_device() ignores the state). Signed-off-by: Ishai Rabinovitz <ishai@mellanox.co.il> Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 8f472e7113b41..ff94e4e326913 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -526,8 +526,10 @@ static int srp_reconnect_target(struct srp_target_port *target) while (ib_poll_cq(target->cq, 1, &wc) > 0) ; /* nothing */ + spin_lock_irq(target->scsi_host->host_lock); list_for_each_entry_safe(req, tmp, &target->req_queue, list) srp_reset_req(target, req); + spin_unlock_irq(target->scsi_host->host_lock); target->rx_head = 0; target->tx_head = 0; -- GitLab