On Wed, Sep 16, 2020 at 08:18:12AM -0500, Shiraz Saleem wrote:
> From: "Sindhu, Devale" <sindhu.devale@xxxxxxxxx>
>
> Occasionally ib_write_bw crash is seen due to
> access of a pd object in i40iw_sc_qp_destroy after it
> is freed. Destroy qp is not synchronous in i40iw and
> thus the iwqp object could be referencing a pd object
> that is freed by ib core as a result of successful
> return from i40iw_destroy_qp.
>
> Wait in i40iw_destroy_qp till all QP references are released
> and destroy the QP and its associated resources before returning.
> Switch to use the refcount API vs atomic API for lifetime
> management of the qp.
>
> RIP: 0010:i40iw_sc_qp_destroy+0x4b/0x120 [i40iw]
> [...]
> RSP: 0018:ffffb4a7042e3ba8 EFLAGS: 00010002
> RAX: 0000000000000000 RBX: 0000000000000001 RCX: dead000000000122
> RDX: ffffb4a7042e3bac RSI: ffff8b7ef9b1e940 RDI: ffff8b7efbf09080
> RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
> R10: 8080808080808080 R11: 0000000000000010 R12: ffff8b7efbf08050
> R13: 0000000000000001 R14: ffff8b7f15042928 R15: ffff8b7ef9b1e940
> FS: 0000000000000000(0000) GS:ffff8b7f2fa00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000400 CR3: 000000020d60a006 CR4: 00000000001606e0
> Call Trace:
> i40iw_exec_cqp_cmd+0x4d3/0x5c0 [i40iw]
> ? try_to_wake_up+0x1ea/0x5d0
> ? __switch_to_asm+0x40/0x70
> i40iw_process_cqp_cmd+0x95/0xa0 [i40iw]
> i40iw_handle_cqp_op+0x42/0x1a0 [i40iw]
> ? cm_event_handler+0x13c/0x1f0 [iw_cm]
> i40iw_rem_ref+0xa0/0xf0 [i40iw]
> cm_work_handler+0x99c/0xd10 [iw_cm]
> process_one_work+0x1a1/0x360
> worker_thread+0x30/0x380
> ? process_one_work+0x360/0x360
> kthread+0x10c/0x130
> ? kthread_park+0x80/0x80
> ret_from_fork+0x35/0x40
>
> Fixes: d37498417947 ("i40iw: add files for iwarp interface")
> Reported-by: Kamal Heib <kheib@xxxxxxxxxx>
> Signed-off-by: Sindhu, Devale <sindhu.devale@xxxxxxxxx>
> Signed-off-by: Shiraz, Saleem <shiraz.saleem@xxxxxxxxx>
> ---
> drivers/infiniband/hw/i40iw/i40iw.h | 9 +++--
> drivers/infiniband/hw/i40iw/i40iw_cm.c | 10 +++---
> drivers/infiniband/hw/i40iw/i40iw_hw.c | 4 +--
> drivers/infiniband/hw/i40iw/i40iw_utils.c | 59 ++++++-------------------------
> drivers/infiniband/hw/i40iw/i40iw_verbs.c | 31 +++++++++++-----
> drivers/infiniband/hw/i40iw/i40iw_verbs.h | 3 +-
> 6 files changed, 45 insertions(+), 71 deletions(-)
Applied to for-next, thanks
Jason
