RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu
authorJason Gunthorpe <jgg@mellanox.com>
Tue, 1 Oct 2019 15:38:19 +0000 (12:38 -0300)
committerJason Gunthorpe <jgg@mellanox.com>
Fri, 4 Oct 2019 18:54:22 +0000 (15:54 -0300)
commitaa116b810ac9077a263ed8679fb4d595f180e0eb
tree0e00e8d84c48e8ce53d2035207be218238e1ebf1
parent9dc775e7f5508f848661bbfb2e15683affb85f24
RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu

During destroy setting live = 0 and then synchronize_srcu() prevents
num_pending_prefetch from incrementing, and also, ensures that all work
holding that count is queued on the WQ. Testing before causes races of the
form:

    CPU0                                         CPU1
  dereg_mr()
                                          mlx5_ib_advise_mr_prefetch()
                srcu_read_lock()
                                            num_pending_prefetch_inc()
      if (!live)
   live = 0
   atomic_read() == 0
     // skip flush_workqueue()
                                              atomic_inc()
        queue_work();
                srcu_read_unlock()
   WARN_ON(atomic_read())  // Fails

Swap the order so that the synchronize_srcu() prevents this.

Fixes: a6bc3875f176 ("IB/mlx5: Protect against prefetch of invalid MR")
Link: https://lore.kernel.org/r/20191001153821.23621-5-jgg@ziepe.ca
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/hw/mlx5/mr.c