IB/sa: Fix sa_local_svc_timeout_ms read race

When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
Reviewed-by: Mark Zhang <markzhang@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index c0a7af1b4fe4b1638d23b7d74daa6827a49c78f9..c23e9c847314149da047d99feb1a3c0a3d235053 100644 (file)
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1074,6 +1074,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
        if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
                timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
 
+       spin_lock_irqsave(&ib_nl_request_lock, flags);
+
        delta = timeout - sa_local_svc_timeout_ms;
        if (delta < 0)
                abs_delta = -delta;
@@ -1081,7 +1083,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
                abs_delta = delta;
 
        if (delta != 0) {
-               spin_lock_irqsave(&ib_nl_request_lock, flags);
                sa_local_svc_timeout_ms = timeout;
                list_for_each_entry(query, &ib_nl_request_list, list) {
                        if (delta < 0 && abs_delta > query->timeout)
@@ -1099,9 +1100,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
                if (delay)
                        mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
                                         (unsigned long)delay);
-               spin_unlock_irqrestore(&ib_nl_request_lock, flags);
        }
 
+       spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
 settimeout_out:
        return 0;
 }