mbox series

[for-next,v4,00/13] Correct race conditions in rdma_rxe

Message ID 20211103050241.61293-1-rpearsonhpe@gmail.com (mailing list archive)
Headers show
Series Correct race conditions in rdma_rxe | expand

Message

Bob Pearson Nov. 3, 2021, 5:02 a.m. UTC 
There are several race conditions discovered in the current rdma_rxe
driver.  They mostly relate to races between normal operations and
destroying objects.  This patch series makes several minor cleanups in
rxe_pool.[ch] and replaces the red-black trees currently used by xarrays
which have better atomic behavior.

This patch series applies cleanly to current for-next.
commit 6a463bc9d999 ("Merge branch 'for-rc' into rdma.git for-next")

Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
---
v4
  Restructured patch series to change to xarray earlier which
  greatly simplified the changes.
  Rebased to current for-next
v3
  Changed rxe_alloc to use GFP_KERNEL
  Addressed other comments by Jason Gunthorp
  Merged the previous 06/10 and 07/10 patches into one since they overlapped
  Added some minor cleanups as 10/10
v2
  Rebased to current for-next.
  Added 4 additional patches

Bob Pearson (13):
  RDMA/rxe: Replace irqsave locks with bh locks
  RDMA/rxe: Cleanup rxe_pool_entry
  RDMA/rxe: Copy setup parameters into rxe_pool
  RDMA/rxe: Save object pointer in pool element
  RDMA/rxe: Replace RB tree by xarray for indexes
  RDMA/rxe: Remove #include "rxe_loc.h" from rxe_pool.c
  RDMA/rxe: Remove some #defines from rxe_pool.h
  RDMA/rxe: Reverse the sense of RXE_POOL_NO_ALLOC
  RDMA/rxe: Replaced keyed rxe objects by indexed objects
  RDMA/rxe: Prevent taking references to dead objects
  RDMA/rxe: Fix ref error in rxe_av.c
  RDMA/rxe: Replace mr by rkey in responder resources
  RDMA/rxe: Protect against race between get_index and drop_ref

 drivers/infiniband/sw/rxe/rxe.c       | 100 +-----
 drivers/infiniband/sw/rxe/rxe_av.c    |  19 +-
 drivers/infiniband/sw/rxe/rxe_comp.c  |   8 +-
 drivers/infiniband/sw/rxe/rxe_cq.c    |  24 +-
 drivers/infiniband/sw/rxe/rxe_loc.h   |  25 +-
 drivers/infiniband/sw/rxe/rxe_mcast.c | 167 ++++++---
 drivers/infiniband/sw/rxe/rxe_mr.c    |   7 +-
 drivers/infiniband/sw/rxe/rxe_mw.c    |  25 +-
 drivers/infiniband/sw/rxe/rxe_net.c   |  17 +-
 drivers/infiniband/sw/rxe/rxe_pool.c  | 479 ++++++++------------------
 drivers/infiniband/sw/rxe/rxe_pool.h  | 129 ++-----
 drivers/infiniband/sw/rxe/rxe_qp.c    |  16 +-
 drivers/infiniband/sw/rxe/rxe_queue.c |   9 +-
 drivers/infiniband/sw/rxe/rxe_recv.c  |   3 +-
 drivers/infiniband/sw/rxe/rxe_req.c   |  66 ++--
 drivers/infiniband/sw/rxe/rxe_resp.c  | 125 ++++---
 drivers/infiniband/sw/rxe/rxe_srq.c   |   2 +-
 drivers/infiniband/sw/rxe/rxe_task.c  |  18 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c |  73 ++--
 drivers/infiniband/sw/rxe/rxe_verbs.h |  23 +-
 20 files changed, 542 insertions(+), 793 deletions(-)

Comments

Jason Gunthorpe Nov. 19, 2021, 5:59 p.m. UTC | #1 
On Wed, Nov 03, 2021 at 12:02:29AM -0500, Bob Pearson wrote:
> There are several race conditions discovered in the current rdma_rxe
> driver.  They mostly relate to races between normal operations and
> destroying objects.  This patch series makes several minor cleanups in
> rxe_pool.[ch] and replaces the red-black trees currently used by xarrays
> which have better atomic behavior.
> 
> This patch series applies cleanly to current for-next.
> commit 6a463bc9d999 ("Merge branch 'for-rc' into rdma.git for-next")
> 
> Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
> v4
>   Restructured patch series to change to xarray earlier which
>   greatly simplified the changes.
>   Rebased to current for-next
> v3
>   Changed rxe_alloc to use GFP_KERNEL
>   Addressed other comments by Jason Gunthorp
>   Merged the previous 06/10 and 07/10 patches into one since they overlapped
>   Added some minor cleanups as 10/10
> v2
>   Rebased to current for-next.
>   Added 4 additional patches
> 
> Bob Pearson (13):
>   RDMA/rxe: Replace irqsave locks with bh locks
>   RDMA/rxe: Cleanup rxe_pool_entry
>   RDMA/rxe: Copy setup parameters into rxe_pool
>   RDMA/rxe: Save object pointer in pool element
>   RDMA/rxe: Remove #include "rxe_loc.h" from rxe_pool.c

I took these patches

>   RDMA/rxe: Replace RB tree by xarray for indexes
>   RDMA/rxe: Remove some #defines from rxe_pool.h
>   RDMA/rxe: Reverse the sense of RXE_POOL_NO_ALLOC
>   RDMA/rxe: Replaced keyed rxe objects by indexed objects
>   RDMA/rxe: Prevent taking references to dead objects
>   RDMA/rxe: Fix ref error in rxe_av.c
>   RDMA/rxe: Replace mr by rkey in responder resources
>   RDMA/rxe: Protect against race between get_index and drop_ref

These need some fixing

Thanks,
Jason