librdmacm/rping: Make sure CQ event thread exits before destroying the CQ

It is possible for the CQ event thread to poll the CQ after it has been
destroyed which can result in a seg fault on T3 interfaces.  This patch
waits for the thread to exit before destroying the CQ.

Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Sean Hefty <sean.hefty@intel.com>

diff --git a/examples/rping.c b/examples/rping.c
index 2d4c2de1d0f756c39b5c66ec1d991a8182061d3e..ee292eca60424509387021adc976168d9ebe6b04 100644 (file)
--- a/examples/rping.c
+++ b/examples/rping.c
@@ -280,12 +280,11 @@ static int rping_cq_event_handler(struct rping_cb *cb)
                ret = 0;
 
                if (wc.status) {
-                       if (wc.status != IBV_WC_WR_FLUSH_ERR) {
+                       if (wc.status != IBV_WC_WR_FLUSH_ERR)
                                fprintf(stderr,
                                        "cq completion failed status %d\n",
                                        wc.status);
-                               ret = -1;
-                       }
+                       ret = -1;
                        goto error;
                }
 
@@ -802,10 +801,9 @@ static void *rping_persistent_server_thread(void *arg)
 
        rping_test_server(cb);
        rdma_disconnect(cb->child_cm_id);
+       pthread_join(cb->cqthread, NULL);
        rping_free_buffers(cb);
        rping_free_qp(cb);
-       pthread_cancel(cb->cqthread);
-       pthread_join(cb->cqthread, NULL);
        rdma_destroy_id(cb->child_cm_id);
        free_cb(cb);
        return NULL;
@@ -890,6 +888,7 @@ static int rping_run_server(struct rping_cb *cb)
 
        rping_test_server(cb);
        rdma_disconnect(cb->child_cm_id);
+       pthread_join(cb->cqthread, NULL);
        rdma_destroy_id(cb->child_cm_id);
 err2:
        rping_free_buffers(cb);
@@ -1057,6 +1056,7 @@ static int rping_run_client(struct rping_cb *cb)
 
        rping_test_client(cb);
        rdma_disconnect(cb->cm_id);
+       pthread_join(cb->cqthread, NULL);
 err2:
        rping_free_buffers(cb);
 err1: