From: Leon Romanovsky <leon@kernel.org>
To: YueHaibing <yuehaibing@huawei.com>
Cc: liangwenpeng@huawei.com, liweihang@huawei.com,
dledford@redhat.com, jgg@ziepe.ca, chenglang@huawei.com,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH -next] RDMA/hns: Fix return in hns_roce_rereg_user_mr()
Date: Thu, 5 Aug 2021 13:58:53 +0300 [thread overview]
Message-ID: <YQvEbUp9cE5G535E@unreal> (raw)
In-Reply-To: <974d3309-3617-6413-5a8d-c92b1b2f8dfe@huawei.com>
On Thu, Aug 05, 2021 at 05:29:25PM +0800, YueHaibing wrote:
> On 2021/8/5 11:40, Leon Romanovsky wrote:
> > On Thu, Aug 05, 2021 at 10:36:03AM +0800, YueHaibing wrote:
> >> On 2021/8/4 21:53, Leon Romanovsky wrote:
> >>> On Wed, Aug 04, 2021 at 08:59:39PM +0800, YueHaibing wrote:
> >>>> If re-registering an MR in hns_roce_rereg_user_mr(), we should
> >>>> return NULL instead of pass 0 to ERR_PTR.
> >>>>
> >>>> Fixes: 4e9fc1dae2a9 ("RDMA/hns: Optimize the MR registration process")
> >>>> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
> >>>> ---
> >>>> drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +++-
> >>>> 1 file changed, 3 insertions(+), 1 deletion(-)
> >>>>
> >>>> diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
> >>>> index 006c84bb3f9f..7089ac780291 100644
> >>>> --- a/drivers/infiniband/hw/hns/hns_roce_mr.c
> >>>> +++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
> >>>> @@ -352,7 +352,9 @@ struct ib_mr *hns_roce_rereg_user_mr(struct ib_mr *ibmr, int flags, u64 start,
> >>>> free_cmd_mbox:
> >>>> hns_roce_free_cmd_mailbox(hr_dev, mailbox);
> >>>>
> >>>> - return ERR_PTR(ret);
> >>>> + if (ret)
> >>>> + return ERR_PTR(ret);
> >>>> + return NULL;
> >>>> }
> >>>
> >>> I don't understand this function, it returns or ERR_PTR() or NULL, but
> >>> should return &mr->ibmr in success path. How does it work?
> >>
> >> Did you means hns_roce_reg_user_mr()?
> >>
> >> hns_roce_rereg_user_mr() returns ERR_PTR() on failure, and return NULL on success,
> >>
> >> In ib_uverbs_rereg_mr(), old mr will be used if rereg_user_mr() return NULL, see:
> >>
> >> 829 new_mr = ib_dev->ops.rereg_user_mr(mr, cmd.flags, cmd.start, cmd.length,
> >> 830 cmd.hca_va, cmd.access_flags, new_pd,
> >> 831 &attrs->driver_udata);
> >> 832 if (IS_ERR(new_mr)) {
> >> 833 ret = PTR_ERR(new_mr);
> >> 834 goto put_new_uobj;
> >> 835 }
> >> 836 if (new_mr) {
> >> .....
> >> 860 mr = new_mr;
> >> 861 } else {
> >> 862 if (cmd.flags & IB_MR_REREG_PD) {
> >> 863 atomic_dec(&orig_pd->usecnt);
> >> 864 mr->pd = new_pd;
> >> 865 atomic_inc(&new_pd->usecnt);
> >> 866 }
> >> 867 if (cmd.flags & IB_MR_REREG_TRANS)
> >> 868 mr->iova = cmd.hca_va;
> >> 869 }
> >
> > You overwrite various fields in old_mr when executing hns_roce_rereg_user_mr().
> > For example mr->access flags, which is not returned to the original
> > state after all failures.
>
> IMO, if ibv_rereg_mr failed, the mr is in undefined state, user needs to call
> ibv_dereg_mr in order to release it, so there no need to recover the original state.
The thing is that it undefined state in the kernel.
What will be if user will change access_flags and try to use that
"broken" MR anyway? Will you catch it?
>
> Also, mlx4_ib_rereg_user_mr seems to do the same thing.
mlx4 does many crazy things.
>
> >
> > Also I'm not so sure about if it is valid to return NULL in all flows.
> >
> > Thanks
> >
> >>
> >>
> >>>
> >>> Thanks
> >>>
> >>>>
> >>>> int hns_roce_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
> >>>> --
> >>>> 2.17.1
> >>>>
> >>> .
> >>>
> > .
> >
next prev parent reply other threads:[~2021-08-05 10:58 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-04 12:59 [PATCH -next] RDMA/hns: Fix return in hns_roce_rereg_user_mr() YueHaibing
2021-08-04 13:53 ` Leon Romanovsky
2021-08-05 2:36 ` YueHaibing
2021-08-05 3:40 ` Leon Romanovsky
2021-08-05 9:29 ` YueHaibing
2021-08-05 10:58 ` Leon Romanovsky [this message]
2021-08-05 12:23 ` Jason Gunthorpe
2021-08-05 12:30 ` Leon Romanovsky
2021-08-19 14:18 ` Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YQvEbUp9cE5G535E@unreal \
--to=leon@kernel.org \
--cc=chenglang@huawei.com \
--cc=dledford@redhat.com \
--cc=jgg@ziepe.ca \
--cc=liangwenpeng@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=liweihang@huawei.com \
--cc=yuehaibing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).