driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

setup_dca_buf_to_hw() was in a spinlock which is a kind of atomic context.

Replace the kvcalloc() with no sleep kcalloc()

Fixes: 12aa71f83089 ("RDMA/hns: Add DCA support for kernel space") Signed-off-by: Chengchang Tang tangchengchang@huawei.com --- drivers/infiniband/hw/hns/hns_roce_dca.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index ef4eda064724..b49a78528ef3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -346,7 +346,7 @@ static int setup_dca_buf_to_hw(struct hns_roce_dev *hr_dev, int ret;

/* alloc a tmp array to store buffer's dma address */ - pages = kvcalloc(count, sizeof(dma_addr_t), GFP_ATOMIC); + pages = kcalloc(count, sizeof(dma_addr_t), GFP_ATOMIC); if (!pages) return -ENOMEM;

@@ -369,7 +369,7 @@ static int setup_dca_buf_to_hw(struct hns_roce_dev *hr_dev, ret = config_dca_qpc(hr_dev, hr_qp, pages, count); err_get_pages: /* drop tmp array */ - kvfree(pages); + kfree(pages);

return ret; }

driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

The code of the current free mr abnormal branch is not readable, resulting in false positives when checked by tools such as smatch.

This patch combines the processing of exception branches into a separate function to improve readability.

Signed-off-by: Chengchang Tang tangchengchang@huawei.com --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 42 ++++++++++++++-------- 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 69f969b7773b..c631ca4b9567 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -2850,6 +2850,19 @@ static struct ib_pd *free_mr_init_pd(struct hns_roce_dev *hr_dev) return pd; }

+static void free_mr_uninit_pd(struct hns_roce_dev *hr_dev) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_free_mr *free_mr = &priv->free_mr; + + if (!free_mr->rsv_pd) + return; + + hns_roce_dealloc_pd(&free_mr->rsv_pd->ibpd, NULL); + kvfree(free_mr->rsv_pd); + free_mr->rsv_pd = NULL; +} + static struct ib_cq *free_mr_init_cq(struct hns_roce_dev *hr_dev) { struct hns_roce_v2_priv *priv = hr_dev->priv; @@ -2887,6 +2900,19 @@ static struct ib_cq *free_mr_init_cq(struct hns_roce_dev *hr_dev) return cq; }

+static void free_mr_uninit_cq(struct hns_roce_dev *hr_dev) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_free_mr *free_mr = &priv->free_mr; + + if (!free_mr->rsv_cq) + return; + + hns_roce_destroy_cq(&free_mr->rsv_cq->ib_cq, NULL); + kvfree(free_mr->rsv_cq); + free_mr->rsv_cq = NULL; +} + static struct hns_roce_qp *create_free_mr_qp(struct hns_roce_dev *hr_dev, struct ib_pd *pd, struct ib_cq *cq) { @@ -2932,16 +2958,6 @@ static void free_mr_exit(struct hns_roce_dev *hr_dev) } }

- if (free_mr->rsv_cq) { - hns_roce_destroy_cq(&free_mr->rsv_cq->ib_cq, NULL); - kfree(free_mr->rsv_cq); - } - - if (free_mr->rsv_pd) { - hns_roce_dealloc_pd(&free_mr->rsv_pd->ibpd, NULL); - free_mr->rsv_pd = NULL; - kfree(free_mr->rsv_pd); - } }

static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) @@ -2976,12 +2992,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) return 0;

create_failed_qp: - hns_roce_destroy_cq(cq, NULL); - kfree(cq); + free_mr_uninit_cq(hr_dev);

create_failed_cq: - hns_roce_dealloc_pd(pd, NULL); - kfree(pd); + free_mr_uninit_pd(hr_dev);

return ret; }

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

The iterated element does not change, making the loop meaningless. This patch fixes it.

Fixes: d8cca476a8d2 ("RDMA/hns: Add method for attaching WQE buffer") Signed-off-by: Chengchang Tang tangchengchang@huawei.com --- drivers/infiniband/hw/hns/hns_roce_dca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index b49a78528ef3..f4501187dc83 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -882,7 +882,7 @@ static int free_buffer_pages_proc(struct dca_mem *mem, int index, void *param) }

for (; changed && i < mem->page_count; i++) - if (dca_page_is_free(state)) + if (dca_page_is_free(&mem->states[i])) free_pages++;

if (changed && free_pages == mem->page_count)

From: Junxian Huang huangjunxian6@hisilicon.com

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

Fix several memory issues in roce bonding: 1. When bond init failed, an error code is returned without device being unregistered. 2. In the abnormal situation where hr_dev may be NULL, the printing in hns_roce_clear_bond() will cause a kernel panic. 3. Though unlikely, there is a time gap between free(die_info) and xa_erase(). This may lead to a potential UAF.

Fixes: e62a20278f18 ("RDMA/hns: support RoCE bonding") Fixes: 82ee5d30a22d ("RDMA/hns: Apply XArray for Bond ID allocation") Fixes: b927e3066992 ("RDMA/hns: Fix the concurrency error between bond and reset.") Signed-off-by: Junxian Huang huangjunxian6@hisilicon.com --- drivers/infiniband/hw/hns/hns_roce_bond.c | 15 ++++++++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 12 +++++++++++- 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_bond.c b/drivers/infiniband/hw/hns/hns_roce_bond.c index f97166031a30..849e2388d181 100644 --- a/drivers/infiniband/hw/hns/hns_roce_bond.c +++ b/drivers/infiniband/hw/hns/hns_roce_bond.c @@ -284,7 +284,8 @@ static void hns_roce_clear_bond(struct hns_roce_bond_group *bond_grp) out: ret = hns_roce_cleanup_bond(bond_grp); if (!ret) - ibdev_info(&hr_dev->ib_dev, "RoCE clear bond finished!\n"); + ibdev_info(&bond_grp->main_hr_dev->ib_dev, + "RoCE clear bond finished!\n"); }

static void hns_roce_slave_changestate(struct hns_roce_bond_group *bond_grp) @@ -558,6 +559,12 @@ static struct hns_roce_die_info *alloc_die_info(int bus_num) return die_info; }

+static void dealloc_die_info(struct hns_roce_die_info *die_info, u8 bus_num) +{ + xa_erase(&roce_bond_xa, bus_num); + kvfree(die_info); +} + static int alloc_bond_id(struct hns_roce_bond_group *bond_grp) { u8 bus_num = bond_grp->bus_num; @@ -599,10 +606,8 @@ static int remove_bond_id(int bus_num, u8 bond_id)

die_info->bond_id_mask &= ~BOND_ID(bond_id); die_info->bgrps[bond_id] = NULL; - if (!die_info->bond_id_mask) { - kfree(die_info); - xa_erase(&roce_bond_xa, bus_num); - } + if (!die_info->bond_id_mask) + dealloc_die_info(die_info, bus_num);

return 0; } diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 4eb18fb31726..9881e84782bd 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -1114,14 +1114,24 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev)

if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_BOND) { ret = hr_dev->hw->bond_init(hr_dev); - if (ret) + if (ret) { dev_err(dev, "roce bond init failed, ret = %d\n", ret); + /* For non-bond devices, the failure of bond_init does + * not affect other functions. + */ + if (hr_dev->hw->bond_is_active(hr_dev)) + goto error_bond_init; + else + ret = 0; + } }

hr_dev->active = true;

return ret;

+error_bond_init: + unregister_netdevice_notifier(&iboe->nb); error_failed_setup_mtu_mac: ib_unregister_device(ib_dev);

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

Reserved QPs and Reserved PD memory was leaked in free_mr_exit(). When a reserved QP fails to be created, the memory of the remaining created reserved QPs is leaked.

Fixes: e89e2d3b692b ("RDMA/hns: Fix gid idx issue caused by free mr") Signed-off-by: Chengchang Tang tangchengchang@huawei.com --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index d831d75673d8..9c54a9bdbe1e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -2942,14 +2942,14 @@ static void free_mr_exit(struct hns_roce_dev *hr_dev) { struct hns_roce_v2_priv *priv = hr_dev->priv; struct hns_roce_v2_free_mr *free_mr = &priv->free_mr; - struct hns_roce_qp *hr_qp; + struct ib_qp *qp; int ret; int i;

for (i = 0; i < ARRAY_SIZE(free_mr->rsv_qp); i++) { if (free_mr->rsv_qp[i]) { - hr_qp = to_hr_qp(&free_mr->rsv_qp[i]->ibqp); - ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, NULL); + qp = &free_mr->rsv_qp[i]->ibqp; + ret = hns_roce_v2_destroy_qp(qp, NULL); if (ret) ibdev_err(&hr_dev->ib_dev, "failed to destroy qp in free mr.\n"); @@ -2992,6 +2992,8 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) return 0;

create_failed_qp: + for (i--; i >= 0; i--) + hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL); free_mr_uninit_cq(hr_dev);

create_failed_cq:

driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F

--------------------------------------------------------------------------

Every xxx_HANLDLE equal 1 << UVERBS_ID_NS_SHIFT, but they have different meanings.

Each xxx_HANDLE represents a specified obj in a specified callback function, so the code using xxx_HANDLE is more readable.

Signed-off-by: Chengchang Tang tangchengchang@huawei.com --- drivers/infiniband/hw/hns/hns_roce_dca.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 349411e160d4..458d3753d56d 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1657,10 +1657,9 @@ DECLARE_UVERBS_NAMED_METHOD( UVERBS_ATTR_TYPE(u32), UA_MANDATORY));

static inline struct hns_roce_qp * -uverbs_attr_to_hr_qp(struct uverbs_attr_bundle *attrs) +uverbs_attr_to_hr_qp(struct uverbs_attr_bundle *attrs, u16 idx) { - struct ib_uobject *uobj = - uverbs_attr_get_uobject(attrs, 1U << UVERBS_ID_NS_SHIFT); + struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs, idx);

if (IS_ERR(uobj)) return ERR_CAST(uobj); @@ -1671,7 +1670,8 @@ uverbs_attr_to_hr_qp(struct uverbs_attr_bundle *attrs) static int UVERBS_HANDLER(HNS_IB_METHOD_DCA_MEM_ATTACH)( struct uverbs_attr_bundle *attrs) { - struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs); + struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs, + HNS_IB_ATTR_DCA_MEM_ATTACH_HANDLE); struct hns_dca_attach_attr attr = {}; struct hns_dca_attach_resp resp = {}; int ret; @@ -1724,7 +1724,8 @@ DECLARE_UVERBS_NAMED_METHOD( static int UVERBS_HANDLER(HNS_IB_METHOD_DCA_MEM_DETACH)( struct uverbs_attr_bundle *attrs) { - struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs); + struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs, + HNS_IB_ATTR_DCA_MEM_DETACH_HANDLE); struct hns_dca_detach_attr attr = {}; int ret;

@@ -1751,7 +1752,8 @@ DECLARE_UVERBS_NAMED_METHOD( static int UVERBS_HANDLER(HNS_IB_METHOD_DCA_MEM_QUERY)( struct uverbs_attr_bundle *attrs) { - struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs); + struct hns_roce_qp *hr_qp = uverbs_attr_to_hr_qp(attrs, + HNS_IB_ATTR_DCA_MEM_QUERY_HANDLE); struct dca_page_query_active_attr active_attr = {}; struct hns_roce_dca_ctx *ctx = NULL; struct hns_roce_dev *hr_dev = NULL;