Skip to content

Commit e2d324a

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe: - syzkaller found a WARN_ON in rxe due to poor lifecycle management of resources linked to skbs - Missing error path handling in erdma qp creation - Initialize the qp number for the GSI QP in erdma - Mismatching of DIP, SCC and QP numbers in hns - SRQ bug fixes in bnxt_re - Memory leak and possibly uninited memory in bnxt_re - Remove retired irdma maintainer - Fix kfree() for kvalloc() in ODP - Fix memory leak in hns * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Fix dip entries leak on devices newer than hip09 RDMA/core: Free pfn_list with appropriate kvfree call MAINTAINERS: Remove bouncing irdma maintainer RDMA/bnxt_re: Fix to initialize the PBL array RDMA/bnxt_re: Fix a possible memory leak in the driver RDMA/bnxt_re: Fix to remove workload check in SRQ limit path RDMA/bnxt_re: Fix to do SRQ armena by default RDMA/hns: Fix querying wrong SCC context for DIP algorithm RDMA/erdma: Fix unset QPN of GSI QP RDMA/erdma: Fix ignored return value of init_kernel_qp RDMA/rxe: Flush delayed SKBs while releasing RXE resources
2 parents c37d2bc + fa2e2d3 commit e2d324a

File tree

12 files changed

+55
-67
lines changed

12 files changed

+55
-67
lines changed

‎MAINTAINERS‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12281,7 +12281,6 @@ F: include/linux/avf/virtchnl.h
1228112281
F: include/linux/net/intel/*/
1228212282

1228312283
INTEL ETHERNET PROTOCOL DRIVER FOR RDMA
12284-
M: Mustafa Ismail <[email protected]>
1228512284
M: Tatyana Nikolova <[email protected]>
1228612285
L: [email protected]
1228712286
S: Supported

‎drivers/infiniband/core/umem_odp.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ static int ib_init_umem_odp(struct ib_umem_odp *umem_odp,
115115

116116
out_free_map:
117117
if (ib_uses_virt_dma(dev))
118-
kfree(map->pfn_list);
118+
kvfree(map->pfn_list);
119119
else
120120
hmm_dma_map_free(dev->dma_device, map);
121121
return ret;
@@ -287,7 +287,7 @@ static void ib_umem_odp_free(struct ib_umem_odp *umem_odp)
287287
mutex_unlock(&umem_odp->umem_mutex);
288288
mmu_interval_notifier_remove(&umem_odp->notifier);
289289
if (ib_uses_virt_dma(dev))
290-
kfree(umem_odp->map.pfn_list);
290+
kvfree(umem_odp->map.pfn_list);
291291
else
292292
hmm_dma_map_free(dev->dma_device, &umem_odp->map);
293293
}

‎drivers/infiniband/hw/bnxt_re/ib_verbs.c‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1921,7 +1921,6 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
19211921
struct bnxt_re_srq *srq = container_of(ib_srq, struct bnxt_re_srq,
19221922
ib_srq);
19231923
struct bnxt_re_dev *rdev = srq->rdev;
1924-
int rc;
19251924

19261925
switch (srq_attr_mask) {
19271926
case IB_SRQ_MAX_WR:
@@ -1933,11 +1932,8 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
19331932
return -EINVAL;
19341933

19351934
srq->qplib_srq.threshold = srq_attr->srq_limit;
1936-
rc = bnxt_qplib_modify_srq(&rdev->qplib_res, &srq->qplib_srq);
1937-
if (rc) {
1938-
ibdev_err(&rdev->ibdev, "Modify HW SRQ failed!");
1939-
return rc;
1940-
}
1935+
bnxt_qplib_srq_arm_db(&srq->qplib_srq.dbinfo, srq->qplib_srq.threshold);
1936+
19411937
/* On success, update the shadow */
19421938
srq->srq_limit = srq_attr->srq_limit;
19431939
/* No need to Build and send response back to udata */

‎drivers/infiniband/hw/bnxt_re/main.c‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2017,6 +2017,28 @@ static void bnxt_re_free_nqr_mem(struct bnxt_re_dev *rdev)
20172017
rdev->nqr = NULL;
20182018
}
20192019

2020+
/* When DEL_GID fails, driver is not freeing GID ctx memory.
2021+
* To avoid the memory leak, free the memory during unload
2022+
*/
2023+
static void bnxt_re_free_gid_ctx(struct bnxt_re_dev *rdev)
2024+
{
2025+
struct bnxt_qplib_sgid_tbl *sgid_tbl = &rdev->qplib_res.sgid_tbl;
2026+
struct bnxt_re_gid_ctx *ctx, **ctx_tbl;
2027+
int i;
2028+
2029+
if (!sgid_tbl->active)
2030+
return;
2031+
2032+
ctx_tbl = sgid_tbl->ctx;
2033+
for (i = 0; i < sgid_tbl->max; i++) {
2034+
if (sgid_tbl->hw_id[i] == 0xFFFF)
2035+
continue;
2036+
2037+
ctx = ctx_tbl[i];
2038+
kfree(ctx);
2039+
}
2040+
}
2041+
20202042
static void bnxt_re_dev_uninit(struct bnxt_re_dev *rdev, u8 op_type)
20212043
{
20222044
u8 type;
@@ -2030,6 +2052,7 @@ static void bnxt_re_dev_uninit(struct bnxt_re_dev *rdev, u8 op_type)
20302052
if (test_and_clear_bit(BNXT_RE_FLAG_QOS_WORK_REG, &rdev->flags))
20312053
cancel_delayed_work_sync(&rdev->worker);
20322054

2055+
bnxt_re_free_gid_ctx(rdev);
20332056
if (test_and_clear_bit(BNXT_RE_FLAG_RESOURCES_INITIALIZED,
20342057
&rdev->flags))
20352058
bnxt_re_cleanup_res(rdev);

‎drivers/infiniband/hw/bnxt_re/qplib_fp.c‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -705,9 +705,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
705705
srq->dbinfo.db = srq->dpi->dbr;
706706
srq->dbinfo.max_slot = 1;
707707
srq->dbinfo.priv_db = res->dpi_tbl.priv_db;
708-
if (srq->threshold)
709-
bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA);
710-
srq->arm_req = false;
708+
bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA);
711709

712710
return 0;
713711
fail:
@@ -717,24 +715,6 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
717715
return rc;
718716
}
719717

720-
int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res,
721-
struct bnxt_qplib_srq *srq)
722-
{
723-
struct bnxt_qplib_hwq *srq_hwq = &srq->hwq;
724-
u32 count;
725-
726-
count = __bnxt_qplib_get_avail(srq_hwq);
727-
if (count > srq->threshold) {
728-
srq->arm_req = false;
729-
bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold);
730-
} else {
731-
/* Deferred arming */
732-
srq->arm_req = true;
733-
}
734-
735-
return 0;
736-
}
737-
738718
int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
739719
struct bnxt_qplib_srq *srq)
740720
{
@@ -776,7 +756,6 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq,
776756
struct bnxt_qplib_hwq *srq_hwq = &srq->hwq;
777757
struct rq_wqe *srqe;
778758
struct sq_sge *hw_sge;
779-
u32 count = 0;
780759
int i, next;
781760

782761
spin_lock(&srq_hwq->lock);
@@ -808,15 +787,8 @@ int bnxt_qplib_post_srq_recv(struct bnxt_qplib_srq *srq,
808787

809788
bnxt_qplib_hwq_incr_prod(&srq->dbinfo, srq_hwq, srq->dbinfo.max_slot);
810789

811-
spin_lock(&srq_hwq->lock);
812-
count = __bnxt_qplib_get_avail(srq_hwq);
813-
spin_unlock(&srq_hwq->lock);
814790
/* Ring DB */
815791
bnxt_qplib_ring_prod_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ);
816-
if (srq->arm_req == true && count > srq->threshold) {
817-
srq->arm_req = false;
818-
bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold);
819-
}
820792

821793
return 0;
822794
}

‎drivers/infiniband/hw/bnxt_re/qplib_fp.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -546,8 +546,6 @@ int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq,
546546
srqn_handler_t srq_handler);
547547
int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
548548
struct bnxt_qplib_srq *srq);
549-
int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res,
550-
struct bnxt_qplib_srq *srq);
551549
int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
552550
struct bnxt_qplib_srq *srq);
553551
void bnxt_qplib_destroy_srq(struct bnxt_qplib_res *res,

‎drivers/infiniband/hw/bnxt_re/qplib_res.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,13 +121,15 @@ static int __alloc_pbl(struct bnxt_qplib_res *res,
121121
pbl->pg_arr = vmalloc_array(pages, sizeof(void *));
122122
if (!pbl->pg_arr)
123123
return -ENOMEM;
124+
memset(pbl->pg_arr, 0, pages * sizeof(void *));
124125

125126
pbl->pg_map_arr = vmalloc_array(pages, sizeof(dma_addr_t));
126127
if (!pbl->pg_map_arr) {
127128
vfree(pbl->pg_arr);
128129
pbl->pg_arr = NULL;
129130
return -ENOMEM;
130131
}
132+
memset(pbl->pg_map_arr, 0, pages * sizeof(dma_addr_t));
131133
pbl->pg_count = 0;
132134
pbl->pg_size = sginfo->pgsize;
133135

‎drivers/infiniband/hw/erdma/erdma_verbs.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -994,6 +994,8 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
994994
old_entry = xa_store(&dev->qp_xa, 1, qp, GFP_KERNEL);
995995
if (xa_is_err(old_entry))
996996
ret = xa_err(old_entry);
997+
else
998+
qp->ibqp.qp_num = 1;
997999
} else {
9981000
ret = xa_alloc_cyclic(&dev->qp_xa, &qp->ibqp.qp_num, qp,
9991001
XA_LIMIT(1, dev->attrs.max_qp - 1),
@@ -1031,7 +1033,9 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
10311033
if (ret)
10321034
goto err_out_cmd;
10331035
} else {
1034-
init_kernel_qp(dev, qp, attrs);
1036+
ret = init_kernel_qp(dev, qp, attrs);
1037+
if (ret)
1038+
goto err_out_xa;
10351039
}
10361040

10371041
qp->attrs.max_send_sge = attrs->cap.max_send_sge;

‎drivers/infiniband/hw/hns/hns_roce_hw_v2.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3043,7 +3043,7 @@ static void hns_roce_v2_exit(struct hns_roce_dev *hr_dev)
30433043
if (!hr_dev->is_vf)
30443044
hns_roce_free_link_table(hr_dev);
30453045

3046-
if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP09)
3046+
if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09)
30473047
free_dip_entry(hr_dev);
30483048
}
30493049

@@ -5476,7 +5476,7 @@ static int hns_roce_v2_query_srqc(struct hns_roce_dev *hr_dev, u32 srqn,
54765476
return ret;
54775477
}
54785478

5479-
static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn,
5479+
static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 sccn,
54805480
void *buffer)
54815481
{
54825482
struct hns_roce_v2_scc_context *context;
@@ -5488,7 +5488,7 @@ static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn,
54885488
return PTR_ERR(mailbox);
54895489

54905490
ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_SCCC,
5491-
qpn);
5491+
sccn);
54925492
if (ret)
54935493
goto out;
54945494

‎drivers/infiniband/hw/hns/hns_roce_restrack.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ int hns_roce_fill_res_qp_entry_raw(struct sk_buff *msg, struct ib_qp *ib_qp)
100100
struct hns_roce_v2_qp_context qpc;
101101
struct hns_roce_v2_scc_context sccc;
102102
} context = {};
103+
u32 sccn = hr_qp->qpn;
103104
int ret;
104105

105106
if (!hr_dev->hw->query_qpc)
@@ -116,7 +117,13 @@ int hns_roce_fill_res_qp_entry_raw(struct sk_buff *msg, struct ib_qp *ib_qp)
116117
!hr_dev->hw->query_sccc)
117118
goto out;
118119

119-
ret = hr_dev->hw->query_sccc(hr_dev, hr_qp->qpn, &context.sccc);
120+
if (hr_qp->cong_type == CONG_TYPE_DIP) {
121+
if (!hr_qp->dip)
122+
goto out;
123+
sccn = hr_qp->dip->dip_idx;
124+
}
125+
126+
ret = hr_dev->hw->query_sccc(hr_dev, sccn, &context.sccc);
120127
if (ret)
121128
ibdev_warn_ratelimited(&hr_dev->ib_dev,
122129
"failed to query SCCC, ret = %d.\n",

0 commit comments

Comments
 (0)