[bug report] RDMA: Globally allocate and release QP memory

[bug report] RDMA: Globally allocate and release QP memory

[Dan Carpenter]

Hello Leon Romanovsky,

The patch 514aee660df4: "RDMA: Globally allocate and release QP
memory" from Jul 23, 2021, leads to the following
Smatch static checker warning:

	lib/kobject.c:289 kobject_set_name_vargs()
	warn: sleeping in atomic context

lib/kobject.c
    281 int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
    282                                   va_list vargs)
    283 {
    284         const char *s;
    285 
    286         if (kobj->name && !fmt)
    287                 return 0;
    288 
--> 289         s = kvasprintf_const(GFP_KERNEL, fmt, vargs);
    290         if (!s)
    291                 return -ENOMEM;
    292 
    293         /*
    294          * ewww... some of these buggers have '/' in the name ... If
    295          * that's the case, we need to make sure we have an actual
    296          * allocated copy to modify, since kvasprintf_const may have
    297          * returned something from .rodata.
    298          */
    299         if (strchr(s, '/')) {
    300                 char *t;
    301 
    302                 t = kstrdup(s, GFP_KERNEL);
    303                 kfree_const(s);
    304                 if (!t)
    305                         return -ENOMEM;
    306                 strreplace(t, '/', '!');
    307                 s = t;
    308         }
    309         kfree_const(kobj->name);
    310         kobj->name = s;
    311 
    312         return 0;
    313 }

The call tree is:

find_free_vf_and_create_qp_grp() <- disables preempt
-> usnic_ib_qp_grp_create()
   -> usnic_ib_sysfs_qpn_add()
      -> kobject_init_and_add()
         -> kobject_add_varg()
            -> kobject_set_name_vargs()

drivers/infiniband/hw/usnic/usnic_ib_verbs.c
   196                  for (i = 0; dev_list[i]; i++) {
   197                          dev = dev_list[i];
   198                          vf = dev_get_drvdata(dev);
   199                          spin_lock(&vf->lock);
                                ^^^^^^^^^^^^^^^^^^^^^
Takes a lock.

   200                          vnic = vf->vnic;
   201                          if (!usnic_vnic_check_room(vnic, res_spec)) {
   202                                  usnic_dbg("Found used vnic %s from %s\n",
   203                                                  dev_name(&us_ibdev->ib_dev.dev),
   204                                                  pci_name(usnic_vnic_get_pdev(
   205                                                                          vnic)));
   206                                  ret = usnic_ib_qp_grp_create(qp_grp,
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This used to be ATOMIC but now there is an allocation hidden deeply
in the kobject code.

   207                                                               us_ibdev->ufdev,
   208                                                               vf, pd, res_spec,
   209                                                               trans_spec);
   210  
   211                                  spin_unlock(&vf->lock);
   212                                  goto qp_grp_check;
   213                          }
   214                          spin_unlock(&vf->lock);
   215  
   216                  }
   217                  usnic_uiom_free_dev_list(dev_list);
   218                  dev_list = NULL;
   219          }
   220  
   221          /* Try to find resources on an unused vf */
   222          list_for_each_entry(vf, &us_ibdev->vf_dev_list, link) {
   223                  spin_lock(&vf->lock);
                        ^^^^^^^^^^^^^^^^^^^^

   224                  vnic = vf->vnic;
   225                  if (vf->qp_grp_ref_cnt == 0 &&
   226                      usnic_vnic_check_room(vnic, res_spec) == 0) {
   227                          ret = usnic_ib_qp_grp_create(qp_grp, us_ibdev->ufdev,
                                      ^^^^^^^^^^^^^^^^^^^^^^
Same thing.

   228                                                       vf, pd, res_spec,
   229                                                       trans_spec);
   230  
   231                          spin_unlock(&vf->lock);
   232                          goto qp_grp_check;
   233                  }
   234                  spin_unlock(&vf->lock);
   235          }
   236  
   237          usnic_info("No free qp grp found on %s\n",

regards,
dan carpenter