Commit 37826f0a authored by Maher Sanalla's avatar Maher Sanalla Committed by Leon Romanovsky
Browse files

IB/mad: Check available slots before posting receive WRs 



The ib_post_receive_mads() function handles posting receive work
requests (WRs) to MAD QPs and is called in two cases:
1) When a MAD port is opened.
2) When a receive WQE is consumed upon receiving a new MAD.

Whereas, if MADs arrive during the port open phase, a race condition
might cause an extra WR to be posted, exceeding the QP’s capacity.
This leads to failures such as:
infiniband mlx5_0: ib_post_recv failed: -12
infiniband mlx5_0: Couldn't post receive WRs
infiniband mlx5_0: Couldn't start port
infiniband mlx5_0: Couldn't open port 1

Fix this by checking the current receive count before posting a new WR.
If the QP’s receive queue is full, do not post additional WRs.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarMaher Sanalla <msanalla@nvidia.com>
Link: https://patch.msgid.link/c4984ba3c3a98a5711a558bccefcad789587ecf1.1741875592.git.leon@kernel.org


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent 0c551745

drivers/infiniband/core/mad.c

+20 −18
Original line number Diff line number Diff line
@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, 
				    struct ib_mad_private *mad)

{

	unsigned long flags;

	int post, ret;

	struct ib_mad_private *mad_priv;

	struct ib_sge sg_list;

	struct ib_recv_wr recv_wr;

	struct ib_mad_queue *recv_queue = &qp_info->recv_queue;

	int ret = 0;



	/* Initialize common scatter list fields */

	sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, 
	recv_wr.sg_list = &sg_list;

	recv_wr.num_sge = 1;



	do {

	while (true) {

		/* Allocate and map receive buffer */

		if (mad) {

			mad_priv = mad;
@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, 
		} else {

			mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),

						     GFP_ATOMIC);

			if (!mad_priv) {

				ret = -ENOMEM;

				break;

			}

			if (!mad_priv)

				return -ENOMEM;

		}

		sg_list.length = mad_priv_dma_size(mad_priv);

		sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, 
						 DMA_FROM_DEVICE);

		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,

						  sg_list.addr))) {

			kfree(mad_priv);

			ret = -ENOMEM;

			break;

			goto free_mad_priv;

		}

		mad_priv->header.mapping = sg_list.addr;

		mad_priv->header.mad_list.mad_queue = recv_queue;

		mad_priv->header.mad_list.cqe.done = ib_mad_recv_done;

		recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe;



		/* Post receive WR */

		spin_lock_irqsave(&recv_queue->lock, flags);

		post = (++recv_queue->count < recv_queue->max_active);

		list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);

		if (recv_queue->count >= recv_queue->max_active) {

			/* Fully populated the receive queue */

			spin_unlock_irqrestore(&recv_queue->lock, flags);

			break;

		}

		recv_queue->count++;

		list_add_tail(&mad_priv->header.mad_list.list,

			      &recv_queue->list);

		spin_unlock_irqrestore(&recv_queue->lock, flags);



		ret = ib_post_recv(qp_info->qp, &recv_wr, NULL);

		if (ret) {

			spin_lock_irqsave(&recv_queue->lock, flags);

			list_del(&mad_priv->header.mad_list.list);

			recv_queue->count--;

			spin_unlock_irqrestore(&recv_queue->lock, flags);

			ib_dma_unmap_single(qp_info->port_priv->device,

					    mad_priv->header.mapping,

					    mad_priv_dma_size(mad_priv),

					    DMA_FROM_DEVICE);

			kfree(mad_priv);

			dev_err(&qp_info->port_priv->device->dev,

				"ib_post_recv failed: %d\n", ret);

			break;

		}

	} while (post);

	}



	ib_dma_unmap_single(qp_info->port_priv->device,

			    mad_priv->header.mapping,

			    mad_priv_dma_size(mad_priv), DMA_FROM_DEVICE);

free_mad_priv:

	kfree(mad_priv);

	return ret;

}