Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

- syzkaller found a WARN_ON in rxe due to poor lifecycle management of
resources linked to skbs

- Missing error path handling in erdma qp creation

- Initialize the qp number for the GSI QP in erdma

- Mismatching of DIP, SCC and QP numbers in hns

- SRQ bug fixes in bnxt_re

- Memory leak and possibly uninited memory in bnxt_re

- Remove retired irdma maintainer

- Fix kfree() for kvalloc() in ODP

- Fix memory leak in hns

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/hns: Fix dip entries leak on devices newer than hip09
RDMA/core: Free pfn_list with appropriate kvfree call
MAINTAINERS: Remove bouncing irdma maintainer
RDMA/bnxt_re: Fix to initialize the PBL array
RDMA/bnxt_re: Fix a possible memory leak in the driver
RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
RDMA/bnxt_re: Fix to do SRQ armena by default
RDMA/hns: Fix querying wrong SCC context for DIP algorithm
RDMA/erdma: Fix unset QPN of GSI QP
RDMA/erdma: Fix ignored return value of init_kernel_qp
RDMA/rxe: Flush delayed SKBs while releasing RXE resources

+55 -67
-1
MAINTAINERS
··· 12281 12281 F: include/linux/net/intel/*/ 12282 12282 12283 12283 INTEL ETHERNET PROTOCOL DRIVER FOR RDMA 12284 - M: Mustafa Ismail <mustafa.ismail@intel.com> 12285 12284 M: Tatyana Nikolova <tatyana.e.nikolova@intel.com> 12286 12285 L: linux-rdma@vger.kernel.org 12287 12286 S: Supported
+2 -2
drivers/infiniband/core/umem_odp.c
··· 115 115 116 116 out_free_map: 117 117 if (ib_uses_virt_dma(dev)) 118 - kfree(map->pfn_list); 118 + kvfree(map->pfn_list); 119 119 else 120 120 hmm_dma_map_free(dev->dma_device, map); 121 121 return ret; ··· 287 287 mutex_unlock(&umem_odp->umem_mutex); 288 288 mmu_interval_notifier_remove(&umem_odp->notifier); 289 289 if (ib_uses_virt_dma(dev)) 290 - kfree(umem_odp->map.pfn_list); 290 + kvfree(umem_odp->map.pfn_list); 291 291 else 292 292 hmm_dma_map_free(dev->dma_device, &umem_odp->map); 293 293 }
+2 -6
drivers/infiniband/hw/bnxt_re/ib_verbs.c
··· 1921 1921 struct bnxt_re_srq *srq = container_of(ib_srq, struct bnxt_re_srq, 1922 1922 ib_srq); 1923 1923 struct bnxt_re_dev *rdev = srq->rdev; 1924 - int rc; 1925 1924 1926 1925 switch (srq_attr_mask) { 1927 1926 case IB_SRQ_MAX_WR: ··· 1932 1933 return -EINVAL; 1933 1934 1934 1935 srq->qplib_srq.threshold = srq_attr->srq_limit; 1935 - rc = bnxt_qplib_modify_srq(&rdev->qplib_res, &srq->qplib_srq); 1936 - if (rc) { 1937 - ibdev_err(&rdev->ibdev, "Modify HW SRQ failed!"); 1938 - return rc; 1939 - } 1936 + bnxt_qplib_srq_arm_db(&srq->qplib_srq.dbinfo, srq->qplib_srq.threshold); 1937 + 1940 1938 /* On success, update the shadow */ 1941 1939 srq->srq_limit = srq_attr->srq_limit; 1942 1940 /* No need to Build and send response back to udata */
+23
drivers/infiniband/hw/bnxt_re/main.c
··· 2017 2017 rdev->nqr = NULL; 2018 2018 } 2019 2019 2020 + /* When DEL_GID fails, driver is not freeing GID ctx memory. 2021 + * To avoid the memory leak, free the memory during unload 2022 + */ 2023 + static void bnxt_re_free_gid_ctx(struct bnxt_re_dev *rdev) 2024 + { 2025 + struct bnxt_qplib_sgid_tbl *sgid_tbl = &rdev->qplib_res.sgid_tbl; 2026 + struct bnxt_re_gid_ctx *ctx, **ctx_tbl; 2027 + int i; 2028 + 2029 + if (!sgid_tbl->active) 2030 + return; 2031 + 2032 + ctx_tbl = sgid_tbl->ctx; 2033 + for (i = 0; i < sgid_tbl->max; i++) { 2034 + if (sgid_tbl->hw_id[i] == 0xFFFF) 2035 + continue; 2036 + 2037 + ctx = ctx_tbl[i]; 2038 + kfree(ctx); 2039 + } 2040 + } 2041 + 2020 2042 static void bnxt_re_dev_uninit(struct bnxt_re_dev *rdev, u8 op_type) 2021 2043 { 2022 2044 u8 type; ··· 2052 2030 if (test_and_clear_bit(BNXT_RE_FLAG_QOS_WORK_REG, &rdev->flags)) 2053 2031 cancel_delayed_work_sync(&rdev->worker); 2054 2032 2033 + bnxt_re_free_gid_ctx(rdev); 2055 2034 if (test_and_clear_bit(BNXT_RE_FLAG_RESOURCES_INITIALIZED, 2056 2035 &rdev->flags)) 2057 2036 bnxt_re_cleanup_res(rdev);
+1 -29
drivers/infiniband/hw/bnxt_re/qplib_fp.c
··· 705 705 srq->dbinfo.db = srq->dpi->dbr; 706 706 srq->dbinfo.max_slot = 1; 707 707 srq->dbinfo.priv_db = res->dpi_tbl.priv_db; 708 - if (srq->threshold) 709 - bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA); 710 - srq->arm_req = false; 708 + bnxt_qplib_armen_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ_ARMENA); 711 709 712 710 return 0; 713 711 fail: ··· 713 715 kfree(srq->swq); 714 716 715 717 return rc; 716 - } 717 - 718 - int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res, 719 - struct bnxt_qplib_srq *srq) 720 - { 721 - struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; 722 - u32 count; 723 - 724 - count = __bnxt_qplib_get_avail(srq_hwq); 725 - if (count > srq->threshold) { 726 - srq->arm_req = false; 727 - bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold); 728 - } else { 729 - /* Deferred arming */ 730 - srq->arm_req = true; 731 - } 732 - 733 - return 0; 734 718 } 735 719 736 720 int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, ··· 756 776 struct bnxt_qplib_hwq *srq_hwq = &srq->hwq; 757 777 struct rq_wqe *srqe; 758 778 struct sq_sge *hw_sge; 759 - u32 count = 0; 760 779 int i, next; 761 780 762 781 spin_lock(&srq_hwq->lock); ··· 787 808 788 809 bnxt_qplib_hwq_incr_prod(&srq->dbinfo, srq_hwq, srq->dbinfo.max_slot); 789 810 790 - spin_lock(&srq_hwq->lock); 791 - count = __bnxt_qplib_get_avail(srq_hwq); 792 - spin_unlock(&srq_hwq->lock); 793 811 /* Ring DB */ 794 812 bnxt_qplib_ring_prod_db(&srq->dbinfo, DBC_DBC_TYPE_SRQ); 795 - if (srq->arm_req == true && count > srq->threshold) { 796 - srq->arm_req = false; 797 - bnxt_qplib_srq_arm_db(&srq->dbinfo, srq->threshold); 798 - } 799 813 800 814 return 0; 801 815 }
-2
drivers/infiniband/hw/bnxt_re/qplib_fp.h
··· 546 546 srqn_handler_t srq_handler); 547 547 int bnxt_qplib_create_srq(struct bnxt_qplib_res *res, 548 548 struct bnxt_qplib_srq *srq); 549 - int bnxt_qplib_modify_srq(struct bnxt_qplib_res *res, 550 - struct bnxt_qplib_srq *srq); 551 549 int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, 552 550 struct bnxt_qplib_srq *srq); 553 551 void bnxt_qplib_destroy_srq(struct bnxt_qplib_res *res,
+2
drivers/infiniband/hw/bnxt_re/qplib_res.c
··· 121 121 pbl->pg_arr = vmalloc_array(pages, sizeof(void *)); 122 122 if (!pbl->pg_arr) 123 123 return -ENOMEM; 124 + memset(pbl->pg_arr, 0, pages * sizeof(void *)); 124 125 125 126 pbl->pg_map_arr = vmalloc_array(pages, sizeof(dma_addr_t)); 126 127 if (!pbl->pg_map_arr) { ··· 129 128 pbl->pg_arr = NULL; 130 129 return -ENOMEM; 131 130 } 131 + memset(pbl->pg_map_arr, 0, pages * sizeof(dma_addr_t)); 132 132 pbl->pg_count = 0; 133 133 pbl->pg_size = sginfo->pgsize; 134 134
+5 -1
drivers/infiniband/hw/erdma/erdma_verbs.c
··· 994 994 old_entry = xa_store(&dev->qp_xa, 1, qp, GFP_KERNEL); 995 995 if (xa_is_err(old_entry)) 996 996 ret = xa_err(old_entry); 997 + else 998 + qp->ibqp.qp_num = 1; 997 999 } else { 998 1000 ret = xa_alloc_cyclic(&dev->qp_xa, &qp->ibqp.qp_num, qp, 999 1001 XA_LIMIT(1, dev->attrs.max_qp - 1), ··· 1033 1031 if (ret) 1034 1032 goto err_out_cmd; 1035 1033 } else { 1036 - init_kernel_qp(dev, qp, attrs); 1034 + ret = init_kernel_qp(dev, qp, attrs); 1035 + if (ret) 1036 + goto err_out_xa; 1037 1037 } 1038 1038 1039 1039 qp->attrs.max_send_sge = attrs->cap.max_send_sge;
+3 -3
drivers/infiniband/hw/hns/hns_roce_hw_v2.c
··· 3043 3043 if (!hr_dev->is_vf) 3044 3044 hns_roce_free_link_table(hr_dev); 3045 3045 3046 - if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP09) 3046 + if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09) 3047 3047 free_dip_entry(hr_dev); 3048 3048 } 3049 3049 ··· 5476 5476 return ret; 5477 5477 } 5478 5478 5479 - static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn, 5479 + static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 sccn, 5480 5480 void *buffer) 5481 5481 { 5482 5482 struct hns_roce_v2_scc_context *context; ··· 5488 5488 return PTR_ERR(mailbox); 5489 5489 5490 5490 ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_SCCC, 5491 - qpn); 5491 + sccn); 5492 5492 if (ret) 5493 5493 goto out; 5494 5494
+8 -1
drivers/infiniband/hw/hns/hns_roce_restrack.c
··· 100 100 struct hns_roce_v2_qp_context qpc; 101 101 struct hns_roce_v2_scc_context sccc; 102 102 } context = {}; 103 + u32 sccn = hr_qp->qpn; 103 104 int ret; 104 105 105 106 if (!hr_dev->hw->query_qpc) ··· 117 116 !hr_dev->hw->query_sccc) 118 117 goto out; 119 118 120 - ret = hr_dev->hw->query_sccc(hr_dev, hr_qp->qpn, &context.sccc); 119 + if (hr_qp->cong_type == CONG_TYPE_DIP) { 120 + if (!hr_qp->dip) 121 + goto out; 122 + sccn = hr_qp->dip->dip_idx; 123 + } 124 + 125 + ret = hr_dev->hw->query_sccc(hr_dev, sccn, &context.sccc); 121 126 if (ret) 122 127 ibdev_warn_ratelimited(&hr_dev->ib_dev, 123 128 "failed to query SCCC, ret = %d.\n",
+8 -21
drivers/infiniband/sw/rxe/rxe_net.c
··· 345 345 346 346 static void rxe_skb_tx_dtor(struct sk_buff *skb) 347 347 { 348 - struct net_device *ndev = skb->dev; 349 - struct rxe_dev *rxe; 350 - unsigned int qp_index; 351 - struct rxe_qp *qp; 348 + struct rxe_qp *qp = skb->sk->sk_user_data; 352 349 int skb_out; 353 350 354 - rxe = rxe_get_dev_from_net(ndev); 355 - if (!rxe && is_vlan_dev(ndev)) 356 - rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev)); 357 - if (WARN_ON(!rxe)) 358 - return; 359 - 360 - qp_index = (int)(uintptr_t)skb->sk->sk_user_data; 361 - if (!qp_index) 362 - return; 363 - 364 - qp = rxe_pool_get_index(&rxe->qp_pool, qp_index); 365 - if (!qp) 366 - goto put_dev; 367 - 368 351 skb_out = atomic_dec_return(&qp->skb_out); 369 - if (qp->need_req_skb && skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW) 352 + if (unlikely(qp->need_req_skb && 353 + skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)) 370 354 rxe_sched_task(&qp->send_task); 371 355 372 356 rxe_put(qp); 373 - put_dev: 374 - ib_device_put(&rxe->ib_dev); 375 357 sock_put(skb->sk); 376 358 } 377 359 ··· 365 383 sock_hold(sk); 366 384 skb->sk = sk; 367 385 skb->destructor = rxe_skb_tx_dtor; 386 + rxe_get(pkt->qp); 368 387 atomic_inc(&pkt->qp->skb_out); 369 388 370 389 if (skb->protocol == htons(ETH_P_IP)) ··· 388 405 sock_hold(sk); 389 406 skb->sk = sk; 390 407 skb->destructor = rxe_skb_tx_dtor; 408 + rxe_get(pkt->qp); 391 409 atomic_inc(&pkt->qp->skb_out); 392 410 393 411 if (skb->protocol == htons(ETH_P_IP)) ··· 480 496 rcu_read_unlock(); 481 497 goto out; 482 498 } 499 + 500 + /* Add time stamp to skb. */ 501 + skb->tstamp = ktime_get(); 483 502 484 503 skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev)); 485 504
+1 -1
drivers/infiniband/sw/rxe/rxe_qp.c
··· 244 244 err = sock_create_kern(&init_net, AF_INET, SOCK_DGRAM, 0, &qp->sk); 245 245 if (err < 0) 246 246 return err; 247 - qp->sk->sk->sk_user_data = (void *)(uintptr_t)qp->elem.index; 247 + qp->sk->sk->sk_user_data = qp; 248 248 249 249 /* pick a source UDP port number for this QP based on 250 250 * the source QPN. this spreads traffic for different QPs