On Mon, Jun 17, 2019 at 07:23:39PM +0000, Saeed Mahameed wrote:
> From: Bodong Wang <bodong@xxxxxxxxxxxx>
>
> When an IB rep is loaded, netdev for the same vport is saved for later
> reference. However, it's not cleaned up when doing unload. For ECPF,
> kernel crashes when driver is referring to the already removed netdev.
>
> Following steps lead to a shown call trace:
> 1. Create n VFs from host PF
> 2. Distroy the VFs
> 3. Run "rdma link" from ARM
>
> Call trace:
> mlx5_ib_get_netdev+0x9c/0xe8 [mlx5_ib]
> mlx5_query_port_roce+0x268/0x558 [mlx5_ib]
> mlx5_ib_rep_query_port+0x14/0x34 [mlx5_ib]
> ib_query_port+0x9c/0xfc [ib_core]
> fill_port_info+0x74/0x28c [ib_core]
> nldev_port_get_doit+0x1a8/0x1e8 [ib_core]
> rdma_nl_rcv_msg+0x16c/0x1c0 [ib_core]
> rdma_nl_rcv+0xe8/0x144 [ib_core]
> netlink_unicast+0x184/0x214
> netlink_sendmsg+0x288/0x354
> sock_sendmsg+0x18/0x2c
> __sys_sendto+0xbc/0x138
> __arm64_sys_sendto+0x28/0x34
> el0_svc_common+0xb0/0x100
> el0_svc_handler+0x6c/0x84
> el0_svc+0x8/0xc
>
> Cleanup the rep and netdev reference when unloading IB rep.
>
> Fixes: 26628e2d58c9 ("RDMA/mlx5: Move to single device multiport ports in switchdev mode")
> Signed-off-by: Bodong Wang <bodong@xxxxxxxxxxxx>
> Reviewed-by: Mark Bloch <markb@xxxxxxxxxxxx>
> Reviewed-by: Parav Pandit <parav@xxxxxxxxxxxx>
> Signed-off-by: Saeed Mahameed <saeedm@xxxxxxxxxxxx>
> ---
> drivers/infiniband/hw/mlx5/ib_rep.c | 18 +++++++++++-------
> 1 file changed, 11 insertions(+), 7 deletions(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
