Patch "RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-siw-fix-duplicated-reported-iw_cm_event_connect.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 22280bf2f6fe975ad06513d92fbe8858ef9865e6
Author: Cheng Xu <chengyou@xxxxxxxxxxxxxxxxx>
Date:   Thu Jul 14 09:30:47 2022 +0800

    RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
    
    [ Upstream commit 3056fc6c32e613b760422b94c7617ac9a24a4721 ]
    
    If siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't
    been received completely, and should not report IW_CM_EVENT_CONNECT_REPLY
    in this case. This may trigger a call trace in iw_cm. A simple way to
    trigger this:
     server: ib_send_lat
     client: ib_send_lat -R <server_ip>
    
    The call trace looks like this:
    
     kernel BUG at drivers/infiniband/core/iwcm.c:894!
     invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
     <...>
     Workqueue: iw_cm_wq cm_work_handler [iw_cm]
     Call Trace:
      <TASK>
      cm_work_handler+0x1dd/0x370 [iw_cm]
      process_one_work+0x1e2/0x3b0
      worker_thread+0x49/0x2e0
      ? rescuer_thread+0x370/0x370
      kthread+0xe5/0x110
      ? kthread_complete_and_exit+0x20/0x20
      ret_from_fork+0x1f/0x30
      </TASK>
    
    Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
    Link: https://lore.kernel.org/r/dae34b5fd5c2ea2bd9744812c1d2653a34a94c67.1657706960.git.chengyou@xxxxxxxxxxxxxxxxx
    Signed-off-by: Cheng Xu <chengyou@xxxxxxxxxxxxxxxxx>
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 3aed597103d3..69fcf21eaf52 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -725,11 +725,11 @@ static int siw_proc_mpareply(struct siw_cep *cep)
 	enum mpa_v2_ctrl mpa_p2p_mode = MPA_V2_RDMA_NO_RTR;
 
 	rv = siw_recv_mpa_rr(cep);
-	if (rv != -EAGAIN)
-		siw_cancel_mpatimer(cep);
 	if (rv)
 		goto out_err;
 
+	siw_cancel_mpatimer(cep);
+
 	rep = &cep->mpa.hdr;
 
 	if (__mpa_rr_revision(rep->params.bits) > MPA_REVISION_2) {
@@ -895,7 +895,8 @@ static int siw_proc_mpareply(struct siw_cep *cep)
 	}
 
 out_err:
-	siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL);
+	if (rv != -EAGAIN)
+		siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL);
 
 	return rv;
 }