Commit 6d7373da authored by Karsten Graul's avatar Karsten Graul Committed by David S. Miller
Browse files

net/smc: fix using of uninitialized completions 



In smc_wr_tx_send_wait() the completion on index specified by
pend->idx is initialized and after smc_wr_tx_send() was called the wait
for completion starts. pend->idx is used to get the correct index for
the wait, but the pend structure could already be cleared in
smc_wr_tx_process_cqe().
Introduce pnd_idx to hold and use a local copy of the correct index.

Fixes: 09c61d24 ("net/smc: wait for departure of an IB message")
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c1833c39

net/smc/smc_wr.c

+4 −2
Original line number Diff line number Diff line
@@ -358,18 +358,20 @@ int smc_wr_tx_send_wait(struct smc_link *link, struct smc_wr_tx_pend_priv *priv, 
			unsigned long timeout)

{

	struct smc_wr_tx_pend *pend;

	u32 pnd_idx;

	int rc;



	pend = container_of(priv, struct smc_wr_tx_pend, priv);

	pend->compl_requested = 1;

	init_completion(&link->wr_tx_compl[pend->idx]);

	pnd_idx = pend->idx;

	init_completion(&link->wr_tx_compl[pnd_idx]);



	rc = smc_wr_tx_send(link, priv);

	if (rc)

		return rc;

	/* wait for completion by smc_wr_tx_process_cqe() */

	rc = wait_for_completion_interruptible_timeout(

					&link->wr_tx_compl[pend->idx], timeout);

					&link->wr_tx_compl[pnd_idx], timeout);

	if (rc <= 0)

		rc = -ENODATA;

	if (rc > 0)