On Sun, Jul 12, 2020 at 01:26:41PM +0300, Leon Romanovsky wrote:
> Fixes: b02a29eb8841 ("mlx5: Convert mlx5_srq_table to XArray")
> Signed-off-by: Maor Gottlieb <maorg@xxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> ---
> v2:
> * Dropped wrong hunk
> v1:
> https://lore.kernel.org/linux-rdma/20200707131551.1153207-1-leon@xxxxxxxxxx
> * I left Fixes as before to make sure that it is taken properly to stable@.
> * xa_lock_irqsave -> xa_lock_irq
But it won't be taken properly to stable. It's true that that's the
earliest version that this applies to, but as far as I can tell the
underlying bug is there a lot earlier. It doesn't appear to be there
in e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c as the cq->lock is taken
irqsafe in mlx5_ib_poll_cq() before calling mlx5_poll_one() which calls
handle_responder() which calls mlx5_core_get_srq(), but it was there
before b02a29eb8841. I think it's up to you to figure out which version
this bug was introduced in, because stable still cares about trees before
5.2 (which is when b02a29eb8841 was introduced). You'll also have to
produce a patch for those earlier kernels.
> v0:
> https://lore.kernel.org/linux-rdma/20200707110612.882962-2-leon@xxxxxxxxxx
> ---
> drivers/infiniband/hw/mlx5/srq_cmd.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/mlx5/srq_cmd.c
> index 6f5eadc4d183..37aaacebd3f2 100644
> --- a/drivers/infiniband/hw/mlx5/srq_cmd.c
> +++ b/drivers/infiniband/hw/mlx5/srq_cmd.c
> @@ -83,11 +83,11 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn)
> struct mlx5_srq_table *table = &dev->srq_table;
> struct mlx5_core_srq *srq;
>
> - xa_lock(&table->array);
> + xa_lock_irq(&table->array);
> srq = xa_load(&table->array, srqn);
> if (srq)
> refcount_inc(&srq->common.refcount);
> - xa_unlock(&table->array);
> + xa_unlock_irq(&table->array);
>
> return srq;
> }
> --
> 2.26.2
>
