From patchwork Wed May 10 10:45:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Selvin Xavier X-Patchwork-Id: 9719651 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A3BE760236 for ; Wed, 10 May 2017 10:46:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 998C42857C for ; Wed, 10 May 2017 10:46:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8E6452858E; Wed, 10 May 2017 10:46:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38E212857C for ; Wed, 10 May 2017 10:46:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752396AbdEJKqJ (ORCPT ); Wed, 10 May 2017 06:46:09 -0400 Received: from mail-qk0-f171.google.com ([209.85.220.171]:35779 "EHLO mail-qk0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752448AbdEJKqI (ORCPT ); Wed, 10 May 2017 06:46:08 -0400 Received: by mail-qk0-f171.google.com with SMTP id a72so24553943qkj.2 for ; Wed, 10 May 2017 03:46:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=fYYgI2JNVUk+my+vR7s9yPLHdvTKB7L1wY7yAQsaBW8=; b=AWuH7l2M9A3R/FFgZVTgcwNxtd66gdR+0R1uTN1VS9Kv9BvOExydB2qUpbO4U9zjAR GrN26VwKXbyqkUVp96i0l4RoERkN+c48uCbfdfAt+5EqG94CrXDqxVoxUX+pR5DyEtLC xFusIMU5dpi5kJ6+YZRMGu2BEmulPcfC/kvgM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=fYYgI2JNVUk+my+vR7s9yPLHdvTKB7L1wY7yAQsaBW8=; b=W79D/w/uR2cMVRiG0UONDzqn5CSUFu61t2ZVAMiW2+muULHx/Gr4kK3YQHCODfhRyU QQ7ISLYim9oFp9xICeWB+p6JX7wNEpwqkzNkO1M6BIRPYb5mC+cbow77dk2sudSr4CX2 wC9Px0aEoIaHx0bni/bD/EgMmKPuzHE+IP2ilqe/E8TtyUjAkR7JYdkOS3yZTmxOGzUw +gT5fp+PxnJB0NFW8co88kJ4o2/czQNllPImjGN1XsXM52j+sebF2DquEb2BPqY4xE4W grR7T5m0lyuSo3HYc9AJ0aiVD2u/wzlrh1HxTtaxKhEDjtnfzBecfTI55ud1gi8wmFg8 yurg== X-Gm-Message-State: AODbwcCezk3hukQbufPl9xnd0ut/Ny1KcXasIVM8ZWqHkHQvBoFjt2Ww mxfUNmLggM1nnG6XnAs= X-Received: by 10.55.41.74 with SMTP id p71mr5079300qkh.110.1494413167630; Wed, 10 May 2017 03:46:07 -0700 (PDT) Received: from dhcp-10-192-206-197.iig.avagotech.net ([192.19.239.250]) by smtp.gmail.com with ESMTPSA id k10sm1868531qke.3.2017.05.10.03.46.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 10 May 2017 03:46:07 -0700 (PDT) From: Selvin Xavier To: dledford@redhat.com, linux-rdma@vger.kernel.org Cc: Selvin Xavier Subject: [PATCH for-next 04/14] RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list Date: Wed, 10 May 2017 03:45:29 -0700 Message-Id: <1494413139-11883-5-git-send-email-selvin.xavier@broadcom.com> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1494413139-11883-1-git-send-email-selvin.xavier@broadcom.com> References: <1494413139-11883-1-git-send-email-selvin.xavier@broadcom.com> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the host buffers are freed before destroying MR in HW, HW could try accessing these buffers. This could cause a host crash. Fixing the code to avoid this condition. Signed-off-by: Selvin Xavier --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index c717d5d..6db218c 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -3043,6 +3043,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) struct bnxt_re_dev *rdev = mr->rdev; int rc = 0; + rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); + if (rc) { + dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc); + return rc; + } + if (mr->npages && mr->pages) { rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res, &mr->qplib_frpl); @@ -3050,8 +3056,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) mr->npages = 0; mr->pages = NULL; } - rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); - if (!IS_ERR(mr->ib_umem) && mr->ib_umem) ib_umem_release(mr->ib_umem);