On Thu, Feb 21, 2019 at 04:13:28AM -0500, Devesh Sharma wrote:
> In the backdrop of ODP changes recently being done in the
The changes were not related to ODP
> kernel ib stack and drivers, there was a regression added
> in the __alloc_pbl path. The change left bnxt_re in DOA
> state in for-next branch.
>
> Fixing the regression to avoid the host crash when a user
> space object is created. Restricting the unconditional
> access to hwq.pg_arr when hwq is initialized for a user
> space object.
.. kernel space object? Isn't it?
> Fixes: commit 161ebe2498d4 ("RDMA/bnxt_re:
> Use for_each_sg_dma_page iterator on umem SGL")
>
> Signed-off-by: Devesh Sharma <devesh.sharma@xxxxxxxxxxxx>
> drivers/infiniband/hw/bnxt_re/ib_verbs.c | 13 +++++++++----
> drivers/infiniband/hw/bnxt_re/qplib_fp.c | 20 ++++++--------------
> drivers/infiniband/hw/bnxt_re/qplib_res.c | 5 +----
> 3 files changed, 16 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index 2ed7786..6150a2f 100644
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -793,9 +793,11 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
> {
> struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
> struct bnxt_re_dev *rdev = qp->rdev;
> - int rc;
> + struct ib_pd *ibpd;
> unsigned int flags;
> + int rc;
>
> + ibpd = qp->ib_qp.pd;
> bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
> rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
> if (rc) {
> @@ -803,9 +805,12 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
> return rc;
> }
>
> - flags = bnxt_re_lock_cqs(qp);
> - bnxt_qplib_clean_qp(&qp->qplib_qp);
> - bnxt_re_unlock_cqs(qp, flags);
> + if (!ibpd->uobject) {
Looks like the qp needs to be tested for 'userness', not the PD. Use
if (!rdma_is_kernel_res(&qp->res))
Jason
