On Mon, Jun 17, 2019 at 07:23:39PM +0000, Saeed Mahameed wrote: > From: Bodong Wang <bodong@xxxxxxxxxxxx> > > When an IB rep is loaded, netdev for the same vport is saved for later > reference. However, it's not cleaned up when doing unload. For ECPF, > kernel crashes when driver is referring to the already removed netdev. > > Following steps lead to a shown call trace: > 1. Create n VFs from host PF > 2. Distroy the VFs > 3. Run "rdma link" from ARM > > Call trace: > mlx5_ib_get_netdev+0x9c/0xe8 [mlx5_ib] > mlx5_query_port_roce+0x268/0x558 [mlx5_ib] > mlx5_ib_rep_query_port+0x14/0x34 [mlx5_ib] > ib_query_port+0x9c/0xfc [ib_core] > fill_port_info+0x74/0x28c [ib_core] > nldev_port_get_doit+0x1a8/0x1e8 [ib_core] > rdma_nl_rcv_msg+0x16c/0x1c0 [ib_core] > rdma_nl_rcv+0xe8/0x144 [ib_core] > netlink_unicast+0x184/0x214 > netlink_sendmsg+0x288/0x354 > sock_sendmsg+0x18/0x2c > __sys_sendto+0xbc/0x138 > __arm64_sys_sendto+0x28/0x34 > el0_svc_common+0xb0/0x100 > el0_svc_handler+0x6c/0x84 > el0_svc+0x8/0xc > > Cleanup the rep and netdev reference when unloading IB rep. > > Fixes: 26628e2d58c9 ("RDMA/mlx5: Move to single device multiport ports in switchdev mode") > Signed-off-by: Bodong Wang <bodong@xxxxxxxxxxxx> > Reviewed-by: Mark Bloch <markb@xxxxxxxxxxxx> > Reviewed-by: Parav Pandit <parav@xxxxxxxxxxxx> > Signed-off-by: Saeed Mahameed <saeedm@xxxxxxxxxxxx> > --- > drivers/infiniband/hw/mlx5/ib_rep.c | 18 +++++++++++------- > 1 file changed, 11 insertions(+), 7 deletions(-) > Thanks, Reviewed-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>