Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6100603 authored by Yishai Hadas's avatar Yishai Hadas Committed by Doug Ledford
Browse files

IB/mlx4: Fix error flow when sending mads under SRIOV 



Fix mad send error flow to prevent double freeing address handles,
and leaking tx_ring entries when SRIOV is active.

If ib_mad_post_send fails, the address handle pointer in the tx_ring entry
must be set to NULL (or there will be a double-free) and tx_tail must be
incremented (or there will be a leak of tx_ring entries).
The tx_ring is handled the same way in the send-completion handler.

Fixes: 37bfc7c1 ("IB/mlx4: SR-IOV multiplex and demultiplex MADs")
Signed-off-by: default avatarYishai Hadas <yishaih@mellanox.com>
Reviewed-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent f2940e2c

drivers/infiniband/hw/mlx4/mad.c

+18 −6
Original line number Diff line number Diff line
@@ -527,7 +527,7 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port, 
		tun_tx_ix = (++tun_qp->tx_ix_head) & (MLX4_NUM_TUNNEL_BUFS - 1);

	spin_unlock(&tun_qp->tx_lock);

	if (ret)

		goto out;

		goto end;



	tun_mad = (struct mlx4_rcv_tunnel_mad *) (tun_qp->tx_ring[tun_tx_ix].buf.addr);

	if (tun_qp->tx_ring[tun_tx_ix].ah)
@@ -596,8 +596,14 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port, 
	wr.wr.send_flags = IB_SEND_SIGNALED;



	ret = ib_post_send(src_qp, &wr.wr, &bad_wr);

	if (!ret)

		return 0;

 out:

	if (ret)

	spin_lock(&tun_qp->tx_lock);

	tun_qp->tx_ix_tail++;

	spin_unlock(&tun_qp->tx_lock);

	tun_qp->tx_ring[tun_tx_ix].ah = NULL;

end:

	ib_destroy_ah(ah);

	return ret;

}
@@ -1326,8 +1332,14 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port, 




	ret = ib_post_send(send_qp, &wr.wr, &bad_wr);

	if (!ret)

		return 0;



	spin_lock(&sqp->tx_lock);

	sqp->tx_ix_tail++;

	spin_unlock(&sqp->tx_lock);

	sqp->tx_ring[wire_tx_ix].ah = NULL;

out:

	if (ret)

	ib_destroy_ah(ah);

	return ret;

}