Commit c964ced7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "Several miscellaneous fixes. A lot of bnxt_re activity, there will be
  more rc patches there coming.

   - Many bnxt_re bug fixes - Memory leaks, kasn, NULL pointer deref,
     soft lockups, error unwinding and some small functional issues

   - Error unwind bug in rdma netlink

   - Two issues with incorrect VLAN detection for iWarp

   - skb_splice_from_iter() splat in siw

   - Give SRP slab caches unique names to resolve the merge window
     WARN_ON regression"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/bnxt_re: Fix the GID table length
  RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
  RDMA/bnxt_re: Change the sequence of updating the CQ toggle value
  RDMA/bnxt_re: Fix an error path in bnxt_re_add_device
  RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
  RDMA/bnxt_re: Fix a possible NULL pointer dereference
  RDMA/bnxt_re: Return more meaningful error
  RDMA/bnxt_re: Fix incorrect dereference of srq in async event
  RDMA/bnxt_re: Fix out of bound check
  RDMA/bnxt_re: Fix the max CQ WQEs for older adapters
  RDMA/srpt: Make slab cache names unique
  RDMA/irdma: Fix misspelling of "accept*"
  RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
  RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
  RDMA/core: Fix ENODEV error for iWARP test over vlan
  RDMA/nldev: Fix NULL pointer dereferences issue in rdma_nl_notify_event
  RDMA/bnxt_re: Fix the max WQEs used in Static WQE mode
  RDMA/bnxt_re: Add a check for memory allocation
  RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
  RDMA/bnxt_re: Fix a possible memory leak
parents 667b1d41 dc5006cf

drivers/infiniband/core/addr.c

+2 −0
Original line number Diff line number Diff line
@@ -269,6 +269,8 @@ rdma_find_ndev_for_src_ip_rcu(struct net *net, const struct sockaddr *src_in) 
		break;

#endif

	}

	if (!ret && dev && is_vlan_dev(dev))

		dev = vlan_dev_real_dev(dev);

	return ret ? ERR_PTR(ret) : dev;

}

drivers/infiniband/core/nldev.c

+2 −0
Original line number Diff line number Diff line
@@ -2816,6 +2816,8 @@ int rdma_nl_notify_event(struct ib_device *device, u32 port_num, 
	nlh = nlmsg_put(skb, 0, 0,

			RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_MONITOR),

			0, 0);

	if (!nlh)

		goto err_free;



	switch (type) {

	case RDMA_REGISTER_EVENT:

drivers/infiniband/hw/bnxt_re/hw_counters.c

+1 −1
Original line number Diff line number Diff line
@@ -366,7 +366,7 @@ int bnxt_re_ib_get_hw_stats(struct ib_device *ibdev, 
				goto done;

			}

		}

		if (rdev->pacing.dbr_pacing)

		if (rdev->pacing.dbr_pacing && bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))

			bnxt_re_copy_db_pacing_stats(rdev, stats);

	}

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+5 −1
Original line number Diff line number Diff line
@@ -1307,7 +1307,11 @@ static int bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, 
			0 : BNXT_QPLIB_RESERVED_QP_WRS;

		entries = bnxt_re_init_depth(entries + diff + 1, uctx);

		sq->max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + diff + 1);

		if (qplqp->wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE)

			sq->max_sw_wqe = bnxt_qplib_get_depth(sq, qplqp->wqe_mode, true);

		else

			sq->max_sw_wqe = sq->max_wqe;



	}

	sq->q_full_delta = diff + 1;

	/*

drivers/infiniband/hw/bnxt_re/main.c

+25 −22
Original line number Diff line number Diff line
@@ -188,8 +188,11 @@ static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev) 


	bnxt_re_set_db_offset(rdev);

	rc = bnxt_qplib_map_db_bar(&rdev->qplib_res);

	if (rc)

	if (rc) {

		kfree(rdev->chip_ctx);

		rdev->chip_ctx = NULL;

		return rc;

	}



	if (bnxt_qplib_determine_atomics(en_dev->pdev))

		ibdev_info(&rdev->ibdev,
@@ -531,6 +534,7 @@ static bool is_dbr_fifo_full(struct bnxt_re_dev *rdev) 
static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev)

{

	struct bnxt_qplib_db_pacing_data *pacing_data = rdev->qplib_res.pacing_data;

	u32 retry_fifo_check = 1000;

	u32 fifo_occup;



	/* loop shouldn't run infintely as the occupancy usually goes
@@ -544,6 +548,14 @@ static void __wait_for_fifo_occupancy_below_th(struct bnxt_re_dev *rdev) 


		if (fifo_occup < pacing_data->pacing_th)

			break;

		if (!retry_fifo_check--) {

			dev_info_once(rdev_to_dev(rdev),

				      "%s: fifo_occup = 0x%xfifo_max_depth = 0x%x pacing_th = 0x%x\n",

				      __func__, fifo_occup, pacing_data->fifo_max_depth,

					pacing_data->pacing_th);

			break;

		}



	}

}
@@ -957,7 +969,7 @@ static int bnxt_re_register_ib(struct bnxt_re_dev *rdev) 
	return ib_register_device(ibdev, "bnxt_re%d", &rdev->en_dev->pdev->dev);

}



static struct bnxt_re_dev *bnxt_re_dev_add(struct bnxt_aux_priv *aux_priv,

static struct bnxt_re_dev *bnxt_re_dev_add(struct auxiliary_device *adev,

					   struct bnxt_en_dev *en_dev)

{

	struct bnxt_re_dev *rdev;
@@ -973,6 +985,7 @@ static struct bnxt_re_dev *bnxt_re_dev_add(struct bnxt_aux_priv *aux_priv, 
	rdev->nb.notifier_call = NULL;

	rdev->netdev = en_dev->net;

	rdev->en_dev = en_dev;

	rdev->adev = adev;

	rdev->id = rdev->en_dev->pdev->devfn;

	INIT_LIST_HEAD(&rdev->qp_list);

	mutex_init(&rdev->qp_lock);
@@ -1025,12 +1038,15 @@ static int bnxt_re_handle_unaffi_async_event(struct creq_func_event 
static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event,

					 struct bnxt_re_qp *qp)

{

	struct bnxt_re_srq *srq = container_of(qp->qplib_qp.srq, struct bnxt_re_srq,

					       qplib_srq);

	struct creq_qp_error_notification *err_event;

	struct bnxt_re_srq *srq = NULL;

	struct ib_event event = {};

	unsigned int flags;



	if (qp->qplib_qp.srq)

		srq =  container_of(qp->qplib_qp.srq, struct bnxt_re_srq,

				    qplib_srq);



	if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR &&

	    rdma_is_kernel_res(&qp->ib_qp.res)) {

		flags = bnxt_re_lock_cqs(qp);
@@ -1258,15 +1274,9 @@ static int bnxt_re_cqn_handler(struct bnxt_qplib_nq *nq, 
{

	struct bnxt_re_cq *cq = container_of(handle, struct bnxt_re_cq,

					     qplib_cq);

	u32 *cq_ptr;



	if (cq->ib_cq.comp_handler) {

		if (cq->uctx_cq_page) {

			cq_ptr = (u32 *)cq->uctx_cq_page;

			*cq_ptr = cq->qplib_cq.toggle;

		}

	if (cq->ib_cq.comp_handler)

		(*cq->ib_cq.comp_handler)(&cq->ib_cq, cq->ib_cq.cq_context);

	}



	return 0;

}
@@ -1823,7 +1833,6 @@ static void bnxt_re_update_en_info_rdev(struct bnxt_re_dev *rdev, 
	 */

	rtnl_lock();

	en_info->rdev = rdev;

	rdev->adev = adev;

	rtnl_unlock();

}
@@ -1840,7 +1849,7 @@ static int bnxt_re_add_device(struct auxiliary_device *adev, u8 op_type) 
	en_dev = en_info->en_dev;





	rdev = bnxt_re_dev_add(aux_priv, en_dev);

	rdev = bnxt_re_dev_add(adev, en_dev);

	if (!rdev || !rdev_to_dev(rdev)) {

		rc = -ENOMEM;

		goto exit;
@@ -1865,12 +1874,14 @@ static int bnxt_re_add_device(struct auxiliary_device *adev, u8 op_type) 
		rdev->nb.notifier_call = NULL;

		pr_err("%s: Cannot register to netdevice_notifier",

		       ROCE_DRV_MODULE_NAME);

		return rc;

		goto re_dev_unreg;

	}

	bnxt_re_setup_cc(rdev, true);



	return 0;



re_dev_unreg:

	ib_unregister_device(&rdev->ibdev);

re_dev_uninit:

	bnxt_re_update_en_info_rdev(NULL, en_info, adev);

	bnxt_re_dev_uninit(rdev, BNXT_RE_COMPLETE_REMOVE);
@@ -2014,15 +2025,7 @@ static int bnxt_re_probe(struct auxiliary_device *adev, 
	auxiliary_set_drvdata(adev, en_info);



	rc = bnxt_re_add_device(adev, BNXT_RE_COMPLETE_INIT);

	if (rc)

		goto err;

	mutex_unlock(&bnxt_re_mutex);

	return 0;



err:

	mutex_unlock(&bnxt_re_mutex);

	bnxt_re_remove(adev);



	return rc;

}