All of lore.kernel.org
 help / color / mirror / Atom feed
* Re: [PATCH 1/1] RDMA/rxe: Fix qp error handler
  2022-05-26  2:54 [PATCH 1/1] RDMA/rxe: Fix qp error handler yanjun.zhu
@ 2022-05-25 12:29 ` Haris Iqbal
  2022-07-04 13:06   ` Jason Gunthorpe
  0 siblings, 1 reply; 4+ messages in thread
From: Haris Iqbal @ 2022-05-25 12:29 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: zyjzyj2000, jgg, leon, linux-rdma, syzbot+833061116fa28df97f3b

On Wed, May 25, 2022 at 12:28 PM <yanjun.zhu@linux.dev> wrote:
>
> From: Zhu Yanjun <yanjun.zhu@linux.dev>
>
> Move the qp error handler to be near the rxe_create_qp.
>
> Reported-by: syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> ---
>  drivers/infiniband/sw/rxe/rxe_qp.c    | 14 ++++++++++----
>  drivers/infiniband/sw/rxe/rxe_verbs.c |  1 -
>  2 files changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
> index 22e9b85344c3..f73ca567a8b3 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -220,8 +220,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
>                            &qp->sq.queue->ip);
>
>         if (err) {
> -               vfree(qp->sq.queue->buf);
> -               kfree(qp->sq.queue);
> +               rxe_queue_cleanup(qp->sq.queue);
>                 qp->sq.queue = NULL;
>                 return err;
>         }
> @@ -277,8 +276,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
>                                    qp->rq.queue->buf, qp->rq.queue->buf_size,
>                                    &qp->rq.queue->ip);
>                 if (err) {
> -                       vfree(qp->rq.queue->buf);
> -                       kfree(qp->rq.queue);
> +                       rxe_queue_cleanup(qp->rq.queue);
>                         qp->rq.queue = NULL;
>                         return err;
>                 }
> @@ -341,6 +339,14 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd,
>         return 0;
>
>  err2:
> +       if (qp_type(qp) == IB_QPT_RC) {
> +               del_timer_sync(&qp->retrans_timer);
> +               del_timer_sync(&qp->rnr_nak_timer);
> +       }
> +
> +       rxe_cleanup_task(&qp->req.task);
> +       rxe_cleanup_task(&qp->comp.task);
> +
>         rxe_queue_cleanup(qp->sq.queue);
>         qp->sq.queue = NULL;
>  err1:
> diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
> index 9d995854a174..d0bc195b572f 100644
> --- a/drivers/infiniband/sw/rxe/rxe_verbs.c
> +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
> @@ -432,7 +432,6 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
>         return 0;
>
>  qp_init:
> -       rxe_put(qp);

Does this mean that in case rxe_qp_init_resp fails (rxe_qp_init_req
had succeeded), we will NOT end up calling rxe_qp_do_cleanup? If so,
would we miss shutting down and releasing qp->sk?

>         return err;
>  }
>
> --
> 2.31.1
>

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [PATCH 1/1] RDMA/rxe: Fix qp error handler
@ 2022-05-26  2:54 yanjun.zhu
  2022-05-25 12:29 ` Haris Iqbal
  0 siblings, 1 reply; 4+ messages in thread
From: yanjun.zhu @ 2022-05-26  2:54 UTC (permalink / raw)
  To: zyjzyj2000, jgg, leon, linux-rdma, yanjun.zhu; +Cc: syzbot+833061116fa28df97f3b

From: Zhu Yanjun <yanjun.zhu@linux.dev>

Move the qp error handler to be near the rxe_create_qp.

Reported-by: syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
---
 drivers/infiniband/sw/rxe/rxe_qp.c    | 14 ++++++++++----
 drivers/infiniband/sw/rxe/rxe_verbs.c |  1 -
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 22e9b85344c3..f73ca567a8b3 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -220,8 +220,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 			   &qp->sq.queue->ip);
 
 	if (err) {
-		vfree(qp->sq.queue->buf);
-		kfree(qp->sq.queue);
+		rxe_queue_cleanup(qp->sq.queue);
 		qp->sq.queue = NULL;
 		return err;
 	}
@@ -277,8 +276,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 				   qp->rq.queue->buf, qp->rq.queue->buf_size,
 				   &qp->rq.queue->ip);
 		if (err) {
-			vfree(qp->rq.queue->buf);
-			kfree(qp->rq.queue);
+			rxe_queue_cleanup(qp->rq.queue);
 			qp->rq.queue = NULL;
 			return err;
 		}
@@ -341,6 +339,14 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd,
 	return 0;
 
 err2:
+	if (qp_type(qp) == IB_QPT_RC) {
+		del_timer_sync(&qp->retrans_timer);
+		del_timer_sync(&qp->rnr_nak_timer);
+	}
+
+	rxe_cleanup_task(&qp->req.task);
+	rxe_cleanup_task(&qp->comp.task);
+
 	rxe_queue_cleanup(qp->sq.queue);
 	qp->sq.queue = NULL;
 err1:
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 9d995854a174..d0bc195b572f 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -432,7 +432,6 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
 	return 0;
 
 qp_init:
-	rxe_put(qp);
 	return err;
 }
 
-- 
2.31.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] RDMA/rxe: Fix qp error handler
  2022-05-25 12:29 ` Haris Iqbal
@ 2022-07-04 13:06   ` Jason Gunthorpe
  2022-07-04 14:18     ` Yanjun Zhu
  0 siblings, 1 reply; 4+ messages in thread
From: Jason Gunthorpe @ 2022-07-04 13:06 UTC (permalink / raw)
  To: Haris Iqbal
  Cc: yanjun.zhu, zyjzyj2000, leon, linux-rdma, syzbot+833061116fa28df97f3b

On Wed, May 25, 2022 at 02:29:06PM +0200, Haris Iqbal wrote:
> > diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
> > index 9d995854a174..d0bc195b572f 100644
> > --- a/drivers/infiniband/sw/rxe/rxe_verbs.c
> > +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
> > @@ -432,7 +432,6 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
> >         return 0;
> >
> >  qp_init:
> > -       rxe_put(qp);
> 
> Does this mean that in case rxe_qp_init_resp fails (rxe_qp_init_req
> had succeeded), we will NOT end up calling rxe_qp_do_cleanup? If so,
> would we miss shutting down and releasing qp->sk?

Zhu??

Jason

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] RDMA/rxe: Fix qp error handler
  2022-07-04 13:06   ` Jason Gunthorpe
@ 2022-07-04 14:18     ` Yanjun Zhu
  0 siblings, 0 replies; 4+ messages in thread
From: Yanjun Zhu @ 2022-07-04 14:18 UTC (permalink / raw)
  To: Jason Gunthorpe, Haris Iqbal
  Cc: zyjzyj2000, leon, linux-rdma, syzbot+833061116fa28df97f3b


在 2022/7/4 21:06, Jason Gunthorpe 写道:
> On Wed, May 25, 2022 at 02:29:06PM +0200, Haris Iqbal wrote:
>>> diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
>>> index 9d995854a174..d0bc195b572f 100644
>>> --- a/drivers/infiniband/sw/rxe/rxe_verbs.c
>>> +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
>>> @@ -432,7 +432,6 @@ static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
>>>          return 0;
>>>
>>>   qp_init:
>>> -       rxe_put(qp);
>> Does this mean that in case rxe_qp_init_resp fails (rxe_qp_init_req
>> had succeeded), we will NOT end up calling rxe_qp_do_cleanup? If so,
>> would we miss shutting down and releasing qp->sk?
> Zhu??

The latest commit will come very soon.

Zhu Yanjun

>
> Jason

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-07-04 14:18 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-26  2:54 [PATCH 1/1] RDMA/rxe: Fix qp error handler yanjun.zhu
2022-05-25 12:29 ` Haris Iqbal
2022-07-04 13:06   ` Jason Gunthorpe
2022-07-04 14:18     ` Yanjun Zhu

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.