From: "Yajun Deng" <yajun.deng@linux.dev>
To: "Leon Romanovsky" <leon@kernel.org>
Cc: "Leon Romanovsky" <leonro@nvidia.com>,
linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org,
"Jason Gunthorpe" <jgg@nvidia.com>
Subject: Re: [PATCH rdma-next] Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
Date: Thu, 10 Mar 2022 06:12:54 +0000 [thread overview]
Message-ID: <18cd9e734496d2ab93cbe77d446fd33d@linux.dev> (raw)
In-Reply-To: <74c11029adaf449b3b9228a77cc82f39e9e892c8.1646851220.git.leonro@nvidia.com>
[-- Attachment #1: Type: text/plain, Size: 7664 bytes --]
Hi, Leon.
Can you test the attached patch? If revert it, ib_qp_usecnt_dec() would called before ib_qp_usecnt_inc() when
create_xrc_qp_user() return error.
Thanks！
-- Yajun
March 10, 2022 2:42 AM, "Leon Romanovsky" <leon@kernel.org> wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
>
> This reverts commit 7c4a539ec38f4ce400a0f3fcb5ff6c940fcd67bb. which
> causes to the following error in mlx4.
>
> [ 679.401416] ------------[ cut here ]------------
> [ 679.403542] Destroy of kernel CQ shouldn't fail
> [ 679.403580] WARNING: CPU: 4 PID: 18064 at include/rdma/ib_verbs.h:3936
> mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
> [ 679.406534] Modules linked in: bonding ib_ipoib ip_gre ipip tunnel4 geneve rdma_ucm nf_tables
> ib_umad mlx4_en mlx4_ib ib_uverbs mlx4_core ip6_gre gre ip6_tunnel tunnel6 iptable_raw openvswitch
> nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack
> xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay
> fuse [last unloaded: mlx4_core]
> [ 679.413323] CPU: 4 PID: 18064 Comm: ibv_xsrq_pingpo Not tainted 5.17.0-rc7_master_62c6ecb #1
> [ 679.415043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
> [ 679.417285] RIP: 0010:mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
> [ 679.418455] Code: 1e 93 08 00 40 80 fd 01 0f 87 fa f1 04 00 83 e5 01 0f 85 2b ff ff ff 48 c7 c7
> 20 4f b6 a0 c6 05 fd 92 08 00 01 e8 47 c9 82 e2 <0f> 0b e9 11 ff ff ff 0f b6 2d eb 92 08 00 40 80
> fd 01 0f 87 b1 f1
> [ 679.421993] RSP: 0018:ffff8881a4957750 EFLAGS: 00010286
> [ 679.423047] RAX: 0000000000000000 RBX: ffff8881ac4b6800 RCX: 0000000000000000
> [ 679.424420] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed103492aedc
> [ 679.425818] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2e378eb
> [ 679.427186] R10: ffffed109a5c6f1d R11: 0000000000000001 R12: ffff888132620000
> [ 679.428553] R13: ffff8881a4957a90 R14: ffff8881aa2d4000 R15: ffff8881a4957ad0
> [ 679.429939] FS: 00007f0401747740(0000) GS:ffff8884d2e00000(0000) knlGS:0000000000000000
> [ 679.431548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 679.432695] CR2: 000055f8ae036118 CR3: 000000012fe94005 CR4: 0000000000370ea0
> [ 679.434099] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 679.435498] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 679.436914] Call Trace:
> [ 679.437510] <TASK>
> [ 679.438042] ib_dealloc_xrcd_user+0xce/0x120 [ib_core]
> [ 679.439245] ib_uverbs_dealloc_xrcd+0xad/0x210 [ib_uverbs]
> [ 679.440385] uverbs_free_xrcd+0xe8/0x190 [ib_uverbs]
> [ 679.441453] destroy_hw_idr_uobject+0x7a/0x130 [ib_uverbs]
> [ 679.442568] uverbs_destroy_uobject+0x164/0x730 [ib_uverbs]
> [ 679.443699] uobj_destroy+0x72/0xf0 [ib_uverbs]
> [ 679.444653] ib_uverbs_cmd_verbs+0x19fb/0x3110 [ib_uverbs]
> [ 679.445805] ? entry_SYSCALL_64_after_hwframe+0x44/0xae
> [ 679.446893] ? uverbs_finalize_object+0x50/0x50 [ib_uverbs]
> [ 679.448037] ? check_chain_key+0x24a/0x580
> [ 679.448919] ? uverbs_fill_udata+0x540/0x540 [ib_uverbs]
> [ 679.450040] ? check_chain_key+0x24a/0x580
> [ 679.450934] ? remove_vma+0xca/0x100
> [ 679.451736] ? lock_acquire+0x1b1/0x4c0
> [ 679.452553] ? lock_acquire+0x1b1/0x4c0
> [ 679.453393] ? ib_uverbs_ioctl+0x11e/0x260 [ib_uverbs]
> [ 679.454438] ? __might_fault+0xb8/0x160
> [ 679.455267] ? lockdep_hardirqs_on_prepare+0x400/0x400
> [ 679.456329] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs]
> [ 679.457384] ? ib_uverbs_ioctl+0x11e/0x260 [ib_uverbs]
> [ 679.458443] ? ib_uverbs_cmd_verbs+0x3110/0x3110 [ib_uverbs]
> [ 679.459598] ? asm_sysvec_apic_timer_interrupt+0x12/0x20
> [ 679.460689] ? mark_held_locks+0x9f/0xe0
> [ 679.461577] __x64_sys_ioctl+0x856/0x1550
> [ 679.462439] ? vfs_fileattr_set+0x9f0/0x9f0
> [ 679.463328] ? __up_read+0x1a3/0x750
> [ 679.464102] ? up_write+0x4a0/0x4a0
> [ 679.464865] ? __vm_munmap+0x22e/0x2e0
> [ 679.465690] ? __x64_sys_brk+0x840/0x840
> [ 679.466519] ? __cond_resched+0x17/0x80
> [ 679.467340] ? lockdep_hardirqs_on_prepare+0x286/0x400
> [ 679.468373] ? syscall_enter_from_user_mode+0x1d/0x50
> [ 679.469411] do_syscall_64+0x3d/0x90
> [ 679.470174] entry_SYSCALL_64_after_hwframe+0x44/0xae
> [ 679.471191] RIP: 0033:0x7f040191917b
> [ 679.471961] Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66
> 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00
> f7 d8 64 89 01 48
> [ 679.475467] RSP: 002b:00007ffce7c4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> [ 679.477014] RAX: ffffffffffffffda RBX: 00007ffce7c4a158 RCX: 00007f040191917b
> [ 679.478434] RDX: 00007ffce7c4a140 RSI: 00000000c0181b01 RDI: 0000000000000003
> [ 679.479840] RBP: 00007ffce7c4a120 R08: 000055f8ae02d080 R09: 0000000000000000
> [ 679.481231] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffce7c4a120
> [ 679.482630] R13: 00007ffce7c4a110 R14: 000055f8ae02f440 R15: 0000000000000000
> [ 679.484003] </TASK>
> [ 679.484535] irq event stamp: 62713
> [ 679.485313] hardirqs last enabled at (62723): [<ffffffff81480f17>] __up_console_sem+0x67/0x70
> [ 679.487019] hardirqs last disabled at (62730): [<ffffffff81480efc>] __up_console_sem+0x4c/0x70
> [ 679.488734] softirqs last enabled at (62220): [<ffffffff8135679f>] __irq_exit_rcu+0x11f/0x170
> [ 679.490569] softirqs last disabled at (62215): [<ffffffff8135679f>] __irq_exit_rcu+0x11f/0x170
> [ 679.503168] ---[ end trace 0000000000000000 ]---
>
> Fixes: 7c4a539ec38f ("RDMA/core: Fix ib_qp_usecnt_dec() called when error")
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
> drivers/infiniband/core/uverbs_cmd.c | 1 +
> drivers/infiniband/core/uverbs_std_types_qp.c | 1 +
> drivers/infiniband/core/verbs.c | 3 ++-
> 3 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
> index 4437f834c0a7..6b6393176b3c 100644
> --- a/drivers/infiniband/core/uverbs_cmd.c
> +++ b/drivers/infiniband/core/uverbs_cmd.c
> @@ -1437,6 +1437,7 @@ static int create_qp(struct uverbs_attr_bundle *attrs,
> ret = PTR_ERR(qp);
> goto err_put;
> }
> + ib_qp_usecnt_inc(qp);
>
> obj->uevent.uobject.object = qp;
> obj->uevent.event_file = READ_ONCE(attrs->ufile->default_async_file);
> diff --git a/drivers/infiniband/core/uverbs_std_types_qp.c
> b/drivers/infiniband/core/uverbs_std_types_qp.c
> index 75353e09c6fe..dd1075466f61 100644
> --- a/drivers/infiniband/core/uverbs_std_types_qp.c
> +++ b/drivers/infiniband/core/uverbs_std_types_qp.c
> @@ -254,6 +254,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
> ret = PTR_ERR(qp);
> goto err_put;
> }
> + ib_qp_usecnt_inc(qp);
>
> if (attr.qp_type == IB_QPT_XRC_TGT) {
> obj->uxrcd = container_of(xrcd_uobj, struct ib_uxrcd_object,
> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index bc9a83f1ca2d..a9819c40a140 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -1245,7 +1245,6 @@ static struct ib_qp *create_qp(struct ib_device *dev, struct ib_pd *pd,
> if (ret)
> goto err_security;
>
> - ib_qp_usecnt_inc(qp);
> rdma_restrack_add(&qp->res);
> return qp;
>
> @@ -1346,6 +1345,8 @@ struct ib_qp *ib_create_qp_kernel(struct ib_pd *pd,
> if (IS_ERR(qp))
> return qp;
>
> + ib_qp_usecnt_inc(qp);
> +
> if (qp_init_attr->cap.max_rdma_ctxs) {
> ret = rdma_rw_init_mrs(qp, qp_init_attr);
> if (ret)
> --
> 2.35.1
[-- Attachment #2: 0001-RDMA-core-Fix-destroy-CQ-error-in-mlx4.patch --]
[-- Type: application/octet-stream, Size: 6662 bytes --]
From dbae9a0822165f7cd51f03f1dc9807ee1bdf5dd7 Mon Sep 17 00:00:00 2001
From: Yajun Deng <yajun.deng@linux.dev>
Date: Thu, 10 Mar 2022 11:50:51 +0800
Subject: [PATCH] RDMA/core: Fix destroy CQ error in mlx4
There are NULL for pd,send_cq,recv_cq,srq in create_xrc_qp_user(), so
ib_qp_usecnt_inc() should after that.
[ 679.401416] ------------[ cut here ]------------
[ 679.403542] Destroy of kernel CQ shouldn't fail
[ 679.403580] WARNING: CPU: 4 PID: 18064 at include/rdma/ib_verbs.h:3936 mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
[ 679.406534] Modules linked in: bonding ib_ipoib ip_gre ipip tunnel4 geneve rdma_ucm nf_tables ib_umad mlx4_en mlx4_ib ib_uverbs mlx4_core ip6_gre gre ip6_tunnel tunnel6 iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay fuse [last unloaded: mlx4_core]
[ 679.413323] CPU: 4 PID: 18064 Comm: ibv_xsrq_pingpo Not tainted 5.17.0-rc7_master_62c6ecb #1
[ 679.415043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 679.417285] RIP: 0010:mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
[ 679.418455] Code: 1e 93 08 00 40 80 fd 01 0f 87 fa f1 04 00 83 e5 01 0f 85 2b ff ff ff 48 c7 c7 20 4f b6 a0 c6 05 fd 92 08 00 01 e8 47 c9 82 e2 <0f> 0b e9 11 ff ff ff 0f b6 2d eb 92 08 00 40 80 fd 01 0f 87 b1 f1
[ 679.421993] RSP: 0018:ffff8881a4957750 EFLAGS: 00010286
[ 679.423047] RAX: 0000000000000000 RBX: ffff8881ac4b6800 RCX: 0000000000000000
[ 679.424420] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed103492aedc
[ 679.425818] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2e378eb
[ 679.427186] R10: ffffed109a5c6f1d R11: 0000000000000001 R12: ffff888132620000
[ 679.428553] R13: ffff8881a4957a90 R14: ffff8881aa2d4000 R15: ffff8881a4957ad0
[ 679.429939] FS: 00007f0401747740(0000) GS:ffff8884d2e00000(0000) knlGS:0000000000000000
[ 679.431548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 679.432695] CR2: 000055f8ae036118 CR3: 000000012fe94005 CR4: 0000000000370ea0
[ 679.434099] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 679.435498] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 679.436914] Call Trace:
[ 679.437510] <TASK>
[ 679.438042] ib_dealloc_xrcd_user+0xce/0x120 [ib_core]
[ 679.439245] ib_uverbs_dealloc_xrcd+0xad/0x210 [ib_uverbs]
[ 679.440385] uverbs_free_xrcd+0xe8/0x190 [ib_uverbs]
[ 679.441453] destroy_hw_idr_uobject+0x7a/0x130 [ib_uverbs]
[ 679.442568] uverbs_destroy_uobject+0x164/0x730 [ib_uverbs]
[ 679.443699] uobj_destroy+0x72/0xf0 [ib_uverbs]
[ 679.444653] ib_uverbs_cmd_verbs+0x19fb/0x3110 [ib_uverbs]
[ 679.445805] ? entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 679.446893] ? uverbs_finalize_object+0x50/0x50 [ib_uverbs]
[ 679.448037] ? check_chain_key+0x24a/0x580
[ 679.448919] ? uverbs_fill_udata+0x540/0x540 [ib_uverbs]
[ 679.450040] ? check_chain_key+0x24a/0x580
[ 679.450934] ? remove_vma+0xca/0x100
[ 679.451736] ? lock_acquire+0x1b1/0x4c0
[ 679.452553] ? lock_acquire+0x1b1/0x4c0
[ 679.453393] ? ib_uverbs_ioctl+0x11e/0x260 [ib_uverbs]
[ 679.454438] ? __might_fault+0xb8/0x160
[ 679.455267] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 679.456329] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs]
[ 679.457384] ? ib_uverbs_ioctl+0x11e/0x260 [ib_uverbs]
[ 679.458443] ? ib_uverbs_cmd_verbs+0x3110/0x3110 [ib_uverbs]
[ 679.459598] ? asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 679.460689] ? mark_held_locks+0x9f/0xe0
[ 679.461577] __x64_sys_ioctl+0x856/0x1550
[ 679.462439] ? vfs_fileattr_set+0x9f0/0x9f0
[ 679.463328] ? __up_read+0x1a3/0x750
[ 679.464102] ? up_write+0x4a0/0x4a0
[ 679.464865] ? __vm_munmap+0x22e/0x2e0
[ 679.465690] ? __x64_sys_brk+0x840/0x840
[ 679.466519] ? __cond_resched+0x17/0x80
[ 679.467340] ? lockdep_hardirqs_on_prepare+0x286/0x400
[ 679.468373] ? syscall_enter_from_user_mode+0x1d/0x50
[ 679.469411] do_syscall_64+0x3d/0x90
[ 679.470174] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 679.471191] RIP: 0033:0x7f040191917b
[ 679.471961] Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48
[ 679.475467] RSP: 002b:00007ffce7c4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 679.477014] RAX: ffffffffffffffda RBX: 00007ffce7c4a158 RCX: 00007f040191917b
[ 679.478434] RDX: 00007ffce7c4a140 RSI: 00000000c0181b01 RDI: 0000000000000003
[ 679.479840] RBP: 00007ffce7c4a120 R08: 000055f8ae02d080 R09: 0000000000000000
[ 679.481231] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffce7c4a120
[ 679.482630] R13: 00007ffce7c4a110 R14: 000055f8ae02f440 R15: 0000000000000000
[ 679.484003] </TASK>
[ 679.484535] irq event stamp: 62713
[ 679.485313] hardirqs last enabled at (62723): [<ffffffff81480f17>] __up_console_sem+0x67/0x70
[ 679.487019] hardirqs last disabled at (62730): [<ffffffff81480efc>] __up_console_sem+0x4c/0x70
[ 679.488734] softirqs last enabled at (62220): [<ffffffff8135679f>] __irq_exit_rcu+0x11f/0x170
[ 679.490569] softirqs last disabled at (62215): [<ffffffff8135679f>] __irq_exit_rcu+0x11f/0x170
[ 679.503168] ---[ end trace 0000000000000000 ]---
Fixes: 7c4a539ec38f ("RDMA/core: Fix ib_qp_usecnt_dec() called when error")
Reported-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
---
drivers/infiniband/core/verbs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index bc9a83f1ca2d..1b0f872c6ef3 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1178,6 +1178,7 @@ static struct ib_qp *create_xrc_qp_user(struct ib_qp *qp,
atomic_inc(&qp_init_attr->xrcd->usecnt);
INIT_LIST_HEAD(&qp->open_list);
+ ib_qp_usecnt_inc(qp);
qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
qp_init_attr->qp_context);
if (IS_ERR(qp))
@@ -1245,7 +1246,6 @@ static struct ib_qp *create_qp(struct ib_device *dev, struct ib_pd *pd,
if (ret)
goto err_security;
- ib_qp_usecnt_inc(qp);
rdma_restrack_add(&qp->res);
return qp;
@@ -1346,6 +1346,8 @@ struct ib_qp *ib_create_qp_kernel(struct ib_pd *pd,
if (IS_ERR(qp))
return qp;
+ ib_qp_usecnt_inc(qp);
+
if (qp_init_attr->cap.max_rdma_ctxs) {
ret = rdma_rw_init_mrs(qp, qp_init_attr);
if (ret)
--
2.25.1
next prev parent reply other threads:[~2022-03-10 6:13 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-09 18:42 [PATCH rdma-next] Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error" Leon Romanovsky
2022-03-10 6:12 ` Yajun Deng [this message]
2022-03-10 9:48 ` Leon Romanovsky
2022-03-10 10:05 ` Yajun Deng
2022-03-14 23:44 ` Jason Gunthorpe
2022-03-16 8:12 ` Leon Romanovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=18cd9e734496d2ab93cbe77d446fd33d@linux.dev \
--to=yajun.deng@linux.dev \
--cc=jgg@nvidia.com \
--cc=leon@kernel.org \
--cc=leonro@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).