Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7616118 authored by Roland Dreier's avatar Roland Dreier Committed by Doug Ledford
Browse files

IB/cm: Fix sleeping in atomic when RoCE is used 



A couple of places in the CM do

    spin_lock_irq(&cm_id_priv->lock);
    ...
    if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))

However when the underlying transport is RoCE, this leads to a sleeping function
being called with the lock held - the callchain is

    cm_alloc_response_msg() ->
      ib_create_ah_from_wc() ->
        ib_init_ah_from_wc() ->
          rdma_addr_find_l2_eth_by_grh() ->
            rdma_resolve_ip()

and rdma_resolve_ip() starts out by doing

    req = kzalloc(sizeof *req, GFP_KERNEL);

not to mention rdma_addr_find_l2_eth_by_grh() doing

    wait_for_completion(&ctx.comp);

to wait for the task that rdma_resolve_ip() queues up.

Fix this by moving the AH creation out of the lock.

Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Reviewed-by: default avatarSean Hefty <sean.hefty@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent f43dbebf

drivers/infiniband/core/cm.c

+44 −19
Original line number Diff line number Diff line
@@ -373,11 +373,19 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, 
	return ret;

}



static int cm_alloc_response_msg(struct cm_port *port,

static struct ib_mad_send_buf *cm_alloc_response_msg_no_ah(struct cm_port *port,

							   struct ib_mad_recv_wc *mad_recv_wc)

{

	return ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,

				  0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,

				  GFP_ATOMIC,

				  IB_MGMT_BASE_VERSION);

}



static int cm_create_response_msg_ah(struct cm_port *port,

				     struct ib_mad_recv_wc *mad_recv_wc,

				 struct ib_mad_send_buf **msg)

				     struct ib_mad_send_buf *msg)

{

	struct ib_mad_send_buf *m;

	struct ib_ah *ah;



	ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
@@ -385,27 +393,40 @@ static int cm_alloc_response_msg(struct cm_port *port, 
	if (IS_ERR(ah))

		return PTR_ERR(ah);



	m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,

			       0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,

			       GFP_ATOMIC,

			       IB_MGMT_BASE_VERSION);

	if (IS_ERR(m)) {

		rdma_destroy_ah(ah);

		return PTR_ERR(m);

	}

	m->ah = ah;

	*msg = m;

	msg->ah = ah;

	return 0;

}



static void cm_free_msg(struct ib_mad_send_buf *msg)

{

	if (msg->ah)

		rdma_destroy_ah(msg->ah);

	if (msg->context[0])

		cm_deref_id(msg->context[0]);

	ib_free_send_mad(msg);

}



static int cm_alloc_response_msg(struct cm_port *port,

				 struct ib_mad_recv_wc *mad_recv_wc,

				 struct ib_mad_send_buf **msg)

{

	struct ib_mad_send_buf *m;

	int ret;



	m = cm_alloc_response_msg_no_ah(port, mad_recv_wc);

	if (IS_ERR(m))

		return PTR_ERR(m);



	ret = cm_create_response_msg_ah(port, mad_recv_wc, m);

	if (ret) {

		cm_free_msg(m);

		return ret;

	}



	*msg = m;

	return 0;

}



static void * cm_copy_private_data(const void *private_data,

				   u8 private_data_len)

{
@@ -2497,7 +2518,8 @@ static int cm_dreq_handler(struct cm_work *work) 
	case IB_CM_TIMEWAIT:

		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].

				counter[CM_DREQ_COUNTER]);

		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))

		msg = cm_alloc_response_msg_no_ah(work->port, work->mad_recv_wc);

		if (IS_ERR(msg))

			goto unlock;



		cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
@@ -2505,7 +2527,8 @@ static int cm_dreq_handler(struct cm_work *work) 
			       cm_id_priv->private_data_len);

		spin_unlock_irq(&cm_id_priv->lock);



		if (ib_post_send_mad(msg, NULL))

		if (cm_create_response_msg_ah(work->port, work->mad_recv_wc, msg) ||

		    ib_post_send_mad(msg, NULL))

			cm_free_msg(msg);

		goto deref;

	case IB_CM_DREQ_RCVD:
@@ -3083,7 +3106,8 @@ static int cm_lap_handler(struct cm_work *work) 
	case IB_CM_MRA_LAP_SENT:

		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].

				counter[CM_LAP_COUNTER]);

		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))

		msg = cm_alloc_response_msg_no_ah(work->port, work->mad_recv_wc);

		if (IS_ERR(msg))

			goto unlock;



		cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
@@ -3093,7 +3117,8 @@ static int cm_lap_handler(struct cm_work *work) 
			      cm_id_priv->private_data_len);

		spin_unlock_irq(&cm_id_priv->lock);



		if (ib_post_send_mad(msg, NULL))

		if (cm_create_response_msg_ah(work->port, work->mad_recv_wc, msg) ||

		    ib_post_send_mad(msg, NULL))

			cm_free_msg(msg);

		goto deref;

	case IB_CM_LAP_RCVD: