From: Leon Romanovsky <leonro@xxxxxxxxxxxx>
In DCT and RSS RAW QP creation flows, the QP mutex wasn't initialized
and the magic field inside lock was missing. This caused to the following
kernel warning for kernels build with CONFIG_DEBUG_MUTEXES.
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 3 PID: 16261 at kernel/locking/mutex.c:938 __mutex_lock+0x60e/0x940
Modules linked in: bonding nf_tables ipip tunnel4 geneve ip6_udp_tunnel udp_tunnel ip6_gre ip6_tunnel tunnel6 ip_gre gre ip_tunnel mlx5_ib mlx5_core mlxfw ptp pps_core rdma_ucm ib_uverbs ib_ipoib ib_umad openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter overlay ib_srp scsi_transport_srp rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core [last unloaded: mlxfw]
CPU: 3 PID: 16261 Comm: ib_send_bw Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
RIP: 0010:__mutex_lock+0x60e/0x940
Code: c0 0f 84 6d fa ff ff 44 8b 15 4e 9d ba 00 45 85 d2 0f 85 5d fa ff ff 48 c7 c6 f2 de 2b 82 48 c7 c7 f1 8a 2b 82 e8 d2 4d 72 ff <0f> 0b 4c 8b 4d 88 e9 3f fa ff ff f6 c2 04 0f 84 37 fe ff ff 48 89
RSP: 0018:ffff88810bb8b870 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88829f1dd880 RSI: 0000000000000000 RDI: ffffffff81192afa
RBP: ffff88810bb8b910 R08: 0000000000000000 R09: 0000000000000028
R10: 0000000000000000 R11: 0000000000003f85 R12: 0000000000000002
R13: ffff88827d8d3ce0 R14: ffffffffa059f615 R15: ffff8882a4d02610
FS: 00007f3f6988e740(0000) GS:ffff8882f5b80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556556158000 CR3: 000000010a63c005 CR4: 0000000000360ea0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? cmd_exec+0x947/0xe60 [mlx5_core]
? __mutex_lock+0x76/0x940
? mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]
mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]
mlx5_ib_counter_bind_qp+0x9b/0xe0 [mlx5_ib]
__rdma_counter_bind_qp+0x6b/0xa0 [ib_core]
rdma_counter_bind_qp_auto+0x363/0x520 [ib_core]
_ib_modify_qp+0x316/0x580 [ib_core]
ib_modify_qp_with_udata+0x19/0x30 [ib_core]
modify_qp+0x4c4/0x600 [ib_uverbs]
ib_uverbs_ex_modify_qp+0x87/0xe0 [ib_uverbs]
ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x129/0x1c0 [ib_uverbs]
ib_uverbs_cmd_verbs.isra.5+0x5d5/0x11f0 [ib_uverbs]
? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x120/0x120 [ib_uverbs]
? lock_acquire+0xb9/0x3a0
? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]
? ib_uverbs_ioctl+0x175/0x210 [ib_uverbs]
ib_uverbs_ioctl+0x14b/0x210 [ib_uverbs]
? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]
ksys_ioctl+0x234/0x7d0
? exc_page_fault+0x202/0x640
? do_syscall_64+0x1f/0x2e0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x59/0x2e0
? asm_exc_page_fault+0x8/0x30
? rcu_read_lock_sched_held+0x52/0x60
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f3f683be267
Code: Bad RIP value.
RSP: 002b:00007ffe3bd0bd08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe3bd0bd98 RCX: 00007f3f683be267
RDX: 00007ffe3bd0bd80 RSI: 00000000c0181b01 RDI: 0000000000000003
RBP: 00007ffe3bd0bd60 R08: 0000000000000005 R09: 00007f3f6985c010
R10: 0000000000001000 R11: 0000000000000246 R12: 00007f3f6985c150
R13: 00007ffe3bd0bd60 R14: 00007ffe3bd0c098 R15: 0000000000000070
irq event stamp: 17737
hardirqs last enabled at (17737): [<ffffffff812e93e2>] kfree+0x142/0x2d0
hardirqs last disabled at (17736): [<ffffffff812e936c>] kfree+0xcc/0x2d0
softirqs last enabled at (16718): [<ffffffff81e002c9>] __do_softirq+0x2c9/0x436
softirqs last disabled at (16709): [<ffffffff81c00f0f>] asm_call_on_stack+0xf/0x20
---[ end trace b82d36d6a8e5bff9 ]---
Fixes: b4aaa1f0b415 ("IB/mlx5: Handle type IB_QPT_DRIVER when creating a QP")
Reviewed-by: Maor Gottlieb <maorg@xxxxxxxxxxxx>
Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
---
drivers/infiniband/hw/mlx5/qp.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 42620f88e393..1225b8d77510 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1852,8 +1852,6 @@ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
u32 *in;
int err;
- mutex_init(&qp->mutex);
-
if (attr->sq_sig_type == IB_SIGNAL_ALL_WR)
qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE;
@@ -1937,7 +1935,6 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
u32 *in;
int err;
- mutex_init(&qp->mutex);
spin_lock_init(&qp->sq.lock);
spin_lock_init(&qp->rq.lock);
@@ -2128,7 +2125,6 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
u32 *in;
int err;
- mutex_init(&qp->mutex);
spin_lock_init(&qp->sq.lock);
spin_lock_init(&qp->rq.lock);
@@ -2969,6 +2965,7 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attr,
goto free_ucmd;
}
+ mutex_init(&qp->mutex);
qp->type = type;
if (udata) {
err = process_vendor_flags(dev, qp, params.ucmd, attr);
--
2.26.2
