Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63b268d2 authored by Raju Rangoju's avatar Raju Rangoju Committed by Doug Ledford
Browse files

IB/isert: Properly release resources on DEVICE_REMOVAL 



When the low level driver exercises the hot unplug they would call
rdma_cm cma_remove_one which would fire DEVICE_REMOVAL event to all cma
consumers. Now, if consumer doesn't make sure they destroy all IB
objects created on that IB device instance prior to finalizing all
processing of DEVICE_REMOVAL callback, rdma_cm will let the lld to
de-register with IB core and destroy the IB device instance. And if the
consumer calls (say) ib_dereg_mr(), it will crash since that dev object
is NULL.

In the current implementation, iser-target just initiates the cleanup
and returns from DEVICE_REMOVAL callback. This deferred work creates a
race between iser-target cleaning IB objects(say MR) and lld destroying
IB device instance.

This patch includes the following fixes
  -> make sure that consumer frees all IB objects associated with device
     instance
  -> return non-zero from the callback to destroy the rdma_cm id

Signed-off-by: default avatarRaju Rangoju <rajur@chelsio.com>
Acked-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 6aaa382f

drivers/infiniband/ulp/isert/ib_isert.c

+20 −3
Original line number Diff line number Diff line
@@ -403,6 +403,7 @@ isert_init_conn(struct isert_conn *isert_conn) 
	INIT_LIST_HEAD(&isert_conn->node);

	init_completion(&isert_conn->login_comp);

	init_completion(&isert_conn->login_req_comp);

	init_waitqueue_head(&isert_conn->rem_wait);

	kref_init(&isert_conn->kref);

	mutex_init(&isert_conn->mutex);

	INIT_WORK(&isert_conn->release_work, isert_release_work);
@@ -578,7 +579,8 @@ isert_connect_release(struct isert_conn *isert_conn) 
	BUG_ON(!device);



	isert_free_rx_descriptors(isert_conn);

	if (isert_conn->cm_id)

	if (isert_conn->cm_id &&

	    !isert_conn->dev_removed)

		rdma_destroy_id(isert_conn->cm_id);



	if (isert_conn->qp) {
@@ -593,6 +595,9 @@ isert_connect_release(struct isert_conn *isert_conn) 


	isert_device_put(device);



	if (isert_conn->dev_removed)

		wake_up_interruptible(&isert_conn->rem_wait);

	else

		kfree(isert_conn);

}
@@ -753,6 +758,7 @@ static int 
isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)

{

	struct isert_np *isert_np = cma_id->context;

	struct isert_conn *isert_conn;

	int ret = 0;



	isert_info("%s (%d): status %d id %p np %p\n",
@@ -773,10 +779,21 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) 
		break;

	case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */

	case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */

	case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */

	case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */

		ret = isert_disconnected_handler(cma_id, event->event);

		break;

	case RDMA_CM_EVENT_DEVICE_REMOVAL:

		isert_conn = cma_id->qp->qp_context;

		isert_conn->dev_removed = true;

		isert_disconnected_handler(cma_id, event->event);

		wait_event_interruptible(isert_conn->rem_wait,

					 isert_conn->state == ISER_CONN_DOWN);

		kfree(isert_conn);

		/*

		 * return non-zero from the callback to destroy

		 * the rdma cm id

		 */

		return 1;

	case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */

	case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */

	case RDMA_CM_EVENT_CONNECT_ERROR:

drivers/infiniband/ulp/isert/ib_isert.h

+2 −0
Original line number Diff line number Diff line
@@ -158,6 +158,8 @@ struct isert_conn { 
	struct work_struct	release_work;

	bool                    logout_posted;

	bool                    snd_w_inv;

	wait_queue_head_t	rem_wait;

	bool			dev_removed;

};



#define ISERT_MAX_CQ 64