mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
f81b33582f
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcf/0x610 mm/kasan/report.c:489
kasan_report+0xb5/0xe0 mm/kasan/report.c:602
rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
__rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
vfs_write fs/read_write.c:677 [inline]
vfs_write+0x26a/0xcc0 fs/read_write.c:659
ksys_write+0x1b8/0x200 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
In the function rxe_create_cq, when rxe_cq_from_init fails, the function
rxe_cleanup will be called to handle the allocated resources. In fact,
some memory resources have already been freed in the function
rxe_cq_from_init. Thus, this problem will occur.
The solution is to let rxe_cleanup do all the work.
Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://paste.ubuntu.com/p/tJgC42wDf6/
Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn>
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250412075714.3257358-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
130 lines
2.9 KiB
C
130 lines
2.9 KiB
C
// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
|
|
/*
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
*/
|
|
#include <linux/vmalloc.h>
|
|
#include "rxe.h"
|
|
#include "rxe_loc.h"
|
|
#include "rxe_queue.h"
|
|
|
|
int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
|
|
int cqe, int comp_vector)
|
|
{
|
|
int count;
|
|
|
|
if (cqe <= 0) {
|
|
rxe_dbg_dev(rxe, "cqe(%d) <= 0\n", cqe);
|
|
goto err1;
|
|
}
|
|
|
|
if (cqe > rxe->attr.max_cqe) {
|
|
rxe_dbg_dev(rxe, "cqe(%d) > max_cqe(%d)\n",
|
|
cqe, rxe->attr.max_cqe);
|
|
goto err1;
|
|
}
|
|
|
|
if (cq) {
|
|
count = queue_count(cq->queue, QUEUE_TYPE_TO_CLIENT);
|
|
if (cqe < count) {
|
|
rxe_dbg_cq(cq, "cqe(%d) < current # elements in queue (%d)\n",
|
|
cqe, count);
|
|
goto err1;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
|
|
err1:
|
|
return -EINVAL;
|
|
}
|
|
|
|
int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
|
|
int comp_vector, struct ib_udata *udata,
|
|
struct rxe_create_cq_resp __user *uresp)
|
|
{
|
|
int err;
|
|
enum queue_type type;
|
|
|
|
type = QUEUE_TYPE_TO_CLIENT;
|
|
cq->queue = rxe_queue_init(rxe, &cqe,
|
|
sizeof(struct rxe_cqe), type);
|
|
if (!cq->queue) {
|
|
rxe_dbg_dev(rxe, "unable to create cq\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
|
|
cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
|
|
if (err)
|
|
return err;
|
|
|
|
cq->is_user = uresp;
|
|
|
|
spin_lock_init(&cq->cq_lock);
|
|
cq->ibcq.cqe = cqe;
|
|
return 0;
|
|
}
|
|
|
|
int rxe_cq_resize_queue(struct rxe_cq *cq, int cqe,
|
|
struct rxe_resize_cq_resp __user *uresp,
|
|
struct ib_udata *udata)
|
|
{
|
|
int err;
|
|
|
|
err = rxe_queue_resize(cq->queue, (unsigned int *)&cqe,
|
|
sizeof(struct rxe_cqe), udata,
|
|
uresp ? &uresp->mi : NULL, NULL, &cq->cq_lock);
|
|
if (!err)
|
|
cq->ibcq.cqe = cqe;
|
|
|
|
return err;
|
|
}
|
|
|
|
/* caller holds reference to cq */
|
|
int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited)
|
|
{
|
|
struct ib_event ev;
|
|
int full;
|
|
void *addr;
|
|
unsigned long flags;
|
|
|
|
spin_lock_irqsave(&cq->cq_lock, flags);
|
|
|
|
full = queue_full(cq->queue, QUEUE_TYPE_TO_CLIENT);
|
|
if (unlikely(full)) {
|
|
rxe_err_cq(cq, "queue full\n");
|
|
spin_unlock_irqrestore(&cq->cq_lock, flags);
|
|
if (cq->ibcq.event_handler) {
|
|
ev.device = cq->ibcq.device;
|
|
ev.element.cq = &cq->ibcq;
|
|
ev.event = IB_EVENT_CQ_ERR;
|
|
cq->ibcq.event_handler(&ev, cq->ibcq.cq_context);
|
|
}
|
|
|
|
return -EBUSY;
|
|
}
|
|
|
|
addr = queue_producer_addr(cq->queue, QUEUE_TYPE_TO_CLIENT);
|
|
memcpy(addr, cqe, sizeof(*cqe));
|
|
|
|
queue_advance_producer(cq->queue, QUEUE_TYPE_TO_CLIENT);
|
|
|
|
if ((cq->notify & IB_CQ_NEXT_COMP) ||
|
|
(cq->notify & IB_CQ_SOLICITED && solicited)) {
|
|
cq->notify = 0;
|
|
cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
|
|
}
|
|
|
|
spin_unlock_irqrestore(&cq->cq_lock, flags);
|
|
|
|
return 0;
|
|
}
|
|
|
|
void rxe_cq_cleanup(struct rxe_pool_elem *elem)
|
|
{
|
|
struct rxe_cq *cq = container_of(elem, typeof(*cq), elem);
|
|
|
|
if (cq->queue)
|
|
rxe_queue_cleanup(cq->queue);
|
|
}
|