From patchwork Wed May 17 09:19:40 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Selvin Xavier X-Patchwork-Id: 9730501 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3AC86602DB for ; Wed, 17 May 2017 09:21:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3758026E39 for ; Wed, 17 May 2017 09:21:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2C75428718; Wed, 17 May 2017 09:21:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CD7AD26E39 for ; Wed, 17 May 2017 09:21:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753720AbdEQJVK (ORCPT ); Wed, 17 May 2017 05:21:10 -0400 Received: from mail-qt0-f171.google.com ([209.85.216.171]:33796 "EHLO mail-qt0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753623AbdEQJVG (ORCPT ); Wed, 17 May 2017 05:21:06 -0400 Received: by mail-qt0-f171.google.com with SMTP id c13so4537471qtc.1 for ; Wed, 17 May 2017 02:21:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nJ0dUKgYMYTpzGLNL+1AwfLNZzqS/WQgJpCkEWFr82E=; b=YVeSAW1GiIERvd+XdXR51migZ79X/005gpe4lroOMtY7FTB4HhHAP+l+qOLzDED8+5 BFqf8DGRXi3UyXly0g5fpeM2aDLp2npgagnWC1d1D0yTpPwMg0a5B8eVTqYbOKT7n/ci L/oGfzbjHomHGg2bRIt7XV/76AlN5cqu2Or4g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nJ0dUKgYMYTpzGLNL+1AwfLNZzqS/WQgJpCkEWFr82E=; b=ZGOIPOXAf4jZC6X4Zq78Uf38dx3gbxPAZ5XuUQS0h+MWVdKDJxcQSA5Y/o5OrWBnaU YxA0fi7rKuWXX/EKBoravFFVTXuDgJ2V7jrdvKCuZuUkbX0K3w+//vA0I5sOZENsuqUE Jln0YhzX38ZuiQZR5NL9ykab4odAnPPEShliW7PkP0r5SqGRPPEv2Gf8BsSPgJO2BLwG gC5/e8LpsqhKZvABXKsvcrMZYv7OMyTWDUaNy1+i64KQzwikW8u1++MHnycOTQiznInD GYeMfLeL3dzgUPdIIiRJ9tNK8/U75/Gk1lMMKx8/Wh6vVz9hHeCUVI+pCTDXuxt3LS1z qNqg== X-Gm-Message-State: AODbwcCWA36MM8C9RaRAoSR73K5C2HcuGu+eQLQzA+AMAT5AU2/tWn2X 2Y5cmPlAiJ0l+BttNxI= X-Received: by 10.200.47.201 with SMTP id m9mr1893860qta.187.1495012860647; Wed, 17 May 2017 02:21:00 -0700 (PDT) Received: from dhcp-10-192-206-197.iig.avagotech.net ([192.19.239.250]) by smtp.gmail.com with ESMTPSA id t136sm998431qke.40.2017.05.17.02.20.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 17 May 2017 02:21:00 -0700 (PDT) From: Selvin Xavier To: dledford@redhat.com Cc: linux-rdma@vger.kernel.org, Selvin Xavier Subject: [PATCH V2 for-next 04/15] RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list Date: Wed, 17 May 2017 02:19:40 -0700 Message-Id: <1495012791-5053-5-git-send-email-selvin.xavier@broadcom.com> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1495012791-5053-1-git-send-email-selvin.xavier@broadcom.com> References: <1495012791-5053-1-git-send-email-selvin.xavier@broadcom.com> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the host buffers are freed before destroying MR in HW, HW could try accessing these buffers. This could cause a host crash. Fixing the code to avoid this condition. Signed-off-by: Selvin Xavier --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index 23f309e..e317783 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -3042,6 +3042,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) struct bnxt_re_dev *rdev = mr->rdev; int rc = 0; + rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); + if (rc) { + dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc); + return rc; + } + if (mr->npages && mr->pages) { rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res, &mr->qplib_frpl); @@ -3049,8 +3055,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) mr->npages = 0; mr->pages = NULL; } - rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); - if (!IS_ERR(mr->ib_umem) && mr->ib_umem) ib_umem_release(mr->ib_umem);