From patchwork Mon May 23 00:32:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Honggang LI X-Patchwork-Id: 9131013 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EB6DF60459 for ; Mon, 23 May 2016 00:32:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C9406281D2 for ; Mon, 23 May 2016 00:32:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A44C828110; Mon, 23 May 2016 00:32:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2507928110 for ; Mon, 23 May 2016 00:32:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752667AbcEWAcQ (ORCPT ); Sun, 22 May 2016 20:32:16 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39651 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752662AbcEWAcP (ORCPT ); Sun, 22 May 2016 20:32:15 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6D843A0A51; Mon, 23 May 2016 00:32:14 +0000 (UTC) Received: from dhcp-13-42.nay.redhat.com (dhcp-13-42.nay.redhat.com [10.66.13.42]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u4N0WBNi000528; Sun, 22 May 2016 20:32:12 -0400 From: Honggang LI To: swise@chelsio.com, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, honli@redhat.com Subject: [PATCH] RDMA/cxgb3: device driver frees DMA memory with different size Date: Mon, 23 May 2016 08:32:09 +0800 Message-Id: <1463963529-23183-1-git-send-email-honli@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Mon, 23 May 2016 00:32:14 +0000 (UTC) Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Honggang Li [ 598.852037] ------------[ cut here ]------------ [ 598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920() [ 598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes] [ 598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod [ 598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1 [ 598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012 [ 598.962193] ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918 [ 598.969663] ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0 [ 598.977132] ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00 [ 598.984602] Call Trace: [ 598.987062] [] dump_stack+0x19/0x1b [ 598.992224] [] warn_slowpath_common+0x70/0xb0 [ 598.998254] [] warn_slowpath_fmt+0x5c/0x80 [ 599.004033] [] check_unmap+0xf8/0x920 [ 599.009369] [] ? sched_clock+0x9/0x10 [ 599.014702] [] debug_dma_free_coherent+0x7e/0xa0 [ 599.021008] [] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3] [ 599.027654] [] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3] [ 599.034307] [] ib_destroy_cq+0x1e/0x30 [ib_core] [ 599.040601] [] ib_uverbs_close+0x302/0x4d0 [ib_uverbs] [ 599.047417] [] __fput+0x102/0x310 [ 599.052401] [] ____fput+0xe/0x10 [ 599.057297] [] task_work_run+0xb4/0xe0 [ 599.062719] [] do_exit+0x304/0xc60 [ 599.067789] [] ? native_sched_clock+0x35/0x80 [ 599.073820] [] ? sched_clock+0x9/0x10 [ 599.079153] [] ? _raw_spin_unlock_irq+0x2c/0x50 [ 599.085358] [] do_group_exit+0x4c/0xc0 [ 599.090779] [] get_signal_to_deliver+0x2e1/0x960 [ 599.097071] [] do_signal+0x57/0x6e0 [ 599.102229] [] ? sysret_signal+0x5/0x4e [ 599.107738] [] do_notify_resume+0x5f/0xb0 [ 599.113418] [] int_signal+0x12/0x17 [ 599.118576] ---[ end trace 1e4653102e7e7019 ]--- [ 599.123211] Mapped at: [ 599.125577] [] debug_dma_alloc_coherent+0x2b/0x80 [ 599.131968] [] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3] [ 599.139920] [] iwch_create_cq+0x105/0x4e0 [iw_cxgb3] [ 599.147895] [] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs] [ 599.156649] [] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs] Fixes: b955150ea784 ('RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error') Signed-off-by: Honggang Li Reviewed-by: Leon Romanovsky Reviewed-by: Steve Wise --- drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c index de1c61b4..ada2e50 100644 --- a/drivers/infiniband/hw/cxgb3/cxio_hal.c +++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c @@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq) kfree(cq->sw_queue); dma_free_coherent(&(rdev_p->rnic_info.pdev->dev), (1UL << (cq->size_log2)) - * sizeof(struct t3_cqe), cq->queue, + * sizeof(struct t3_cqe) + 1, cq->queue, dma_unmap_addr(cq, mapping)); cxio_hal_put_cqid(rdev_p->rscp, cq->cqid); return err;