[PATCH] net/ncsi: Fix race condition dropping response packet

[Gavin Shan]

The pair of NCSI command/response are associated with NCSI request.
There is one field in the struct (@nr_timer_enabled) that indicates
the timer associated with the NCSI request has been enabled. That
also implicitly indicates the NCSI request packet has been sent out
successfully. Any received NCSI responses that don't have the
accompanying NCSI request will be dropped. We could possibly run
into race condition in ncsi_xmit_cmd(): dev_queue_xmit() is called
to send the NCSI request packet, then we receive it's response
packet before nr->nr_timer_enabled is set to true. That leads to
the NCSI response packet is dropped and NCSI interface can't be
brought up successfully.

This fixes the issue by setting the flag (nr->nr_timer_enabled) to
true before ncsi_xmit_cmd() is called.

Reported-by: Cyril Bur <cyrilbur at gmail.com>
Signed-off-by: Gavin Shan <gwshan at linux.vnet.ibm.com>
Tested-by: Cyril Bur <cyrilbur at gmail.com>
---
 net/ncsi/ncsi-cmd.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c
index b8503e1..8f75828 100644
--- a/net/ncsi/ncsi-cmd.c
+++ b/net/ncsi/ncsi-cmd.c
@@ -359,12 +359,6 @@ int ncsi_xmit_cmd(struct ncsi_cmd_arg *nca)
 		eh->h_source[i] = 0xff;
 	}
 
-	/* Send NCSI packet */
-	skb_get(nr->nr_cmd);
-	ret = dev_queue_xmit(nr->nr_cmd);
-	if (ret)
-		goto out;
-
 	/* Start the timer for the request that might not have
 	 * corresponding response. I'm not sure 1 second delay
 	 * here is enough. Anyway, NCSI is internal network, so
@@ -373,6 +367,13 @@ int ncsi_xmit_cmd(struct ncsi_cmd_arg *nca)
 	nr->nr_timer_enabled = true;
 	mod_timer(&nr->nr_timer, jiffies + 1 * HZ);
 
+
+	/* Send NCSI packet */
+	skb_get(nr->nr_cmd);
+	ret = dev_queue_xmit(nr->nr_cmd);
+	if (ret)
+		goto out;
+
 	return 0;
 out:
 	ncsi_free_req(nr, false, false);
-- 
2.1.0