On Thu, Oct 28, 2021 at 08:55:22AM +0300, Leon Romanovsky wrote: > From: Aharon Landau <aharonl@xxxxxxxxxx> > > The vendors set the IOVA of newly created MRs in rereg_user_mr, so don't > overwrite it. That ensures that this field is set only if IB_MR_REREG_TRANS > flag is provided. > > Fixes: 6e0954b11c05 ("RDMA/uverbs: Allow drivers to create a new HW object during rereg_mr") > Signed-off-by: Aharon Landau <aharonl@xxxxxxxxxx> > Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx> > --- > drivers/infiniband/core/uverbs_cmd.c | 3 --- > 1 file changed, 3 deletions(-) I rewrote the commit message: RDMA/core: Require the driver to set the IOVA correctly during rereg_mr If the driver returns a new MR during rereg it has to fill it with the IOVA from the proper source. If IB_MR_REREG_TRANS is set then the IOVA is cmd.hca_va, otherwise the IOVA comes from the old MR. mlx5 for example has two calls inside rereg_mr: return create_real_mr(new_pd, umem, mr->ibmr.iova, new_access_flags); and return create_real_mr(new_pd, new_umem, iova, new_access_flags); Unconditionally overwriting the iova in the newly allocated MR will corrupt the iova if the first path is used. Remove the redundant initializations from ib_uverbs_rereg_mr(). Fixes: 6e0954b11c05 ("RDMA/uverbs: Allow drivers to create a new HW object during rereg_mr") Link: https://lore.kernel.org/r/4b0a31bbc372842613286a10d7a8cbb0ee6069c7.1635400472.git.leonro@xxxxxxxxxx Signed-off-by: Aharon Landau <aharonl@xxxxxxxxxx> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx> Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx> Jason