c35fab9925
The last commit was found when I created a XRC SRQ in lock-free mode but failed to destroy it because of the refcnt check added in the previous commit. The failure was because the PAD was acquired through ibv_srq->pd in destroy_srq(), while ibv_srq->pd wasn't assigned when the SRQ was created by ibv_create_srq_ex(). So let's assign ibv_srq->pd in the common ibv_icmd_create_srq() , so that drivers can get the correct pd no matter which api the SRQ is created by. Signed-off-by: Xinghai Cen <cenxinghai@h-partners.com> (cherry picked from commit 3ac30fc125c7cff122f21ff8593294060c92429f)
100 lines
3.0 KiB
Diff
100 lines
3.0 KiB
Diff
From e45b9c648476b1b56592a873fa71699cb7f32ffd Mon Sep 17 00:00:00 2001
|
|
From: Junxian Huang <huangjunxian6@hisilicon.com>
|
|
Date: Wed, 23 Apr 2025 16:55:15 +0800
|
|
Subject: [PATCH 60/62] libhns: Fix pad refcnt leaking in error flow of create
|
|
qp/cq/srq
|
|
|
|
mainline inclusion
|
|
from mainline-v56.0-65
|
|
commit f877d6e610e438515e1535c9ec7a3a3ef37c58e0
|
|
category: bugfix
|
|
bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/IC3X57
|
|
CVE: NA
|
|
|
|
Reference:
|
|
https://github.com/linux-rdma/rdma-core/pull/1599/commits/f877d6e610e438515e...
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
Decrease pad refcnt by 1 in error flow of create qp/cq/srq.
|
|
|
|
Fixes: f8b4f622b1c5 ("libhns: Add support for lock-free QP")
|
|
Fixes: 95225025e24c ("libhns: Add support for lock-free CQ")
|
|
Fixes: aa7bcf7f7e44 ("libhns: Add support for lock-free SRQ")
|
|
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
|
|
Signed-off-by: Xinghai Cen <cenxinghai@h-partners.com>
|
|
---
|
|
providers/hns/hns_roce_u_verbs.c | 20 +++++++++++++-------
|
|
1 file changed, 13 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c
|
|
index e0bafe3..70f516a 100644
|
|
--- a/providers/hns/hns_roce_u_verbs.c
|
|
+++ b/providers/hns/hns_roce_u_verbs.c
|
|
@@ -445,12 +445,9 @@ static int verify_cq_create_attr(struct ibv_cq_init_attr_ex *attr,
|
|
return EOPNOTSUPP;
|
|
}
|
|
|
|
- if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD) {
|
|
- if (!pad) {
|
|
- verbs_err(&context->ibv_ctx, "failed to check the pad of cq.\n");
|
|
- return EINVAL;
|
|
- }
|
|
- atomic_fetch_add(&pad->pd.refcount, 1);
|
|
+ if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD && !pad) {
|
|
+ verbs_err(&context->ibv_ctx, "failed to check the pad of cq.\n");
|
|
+ return EINVAL;
|
|
}
|
|
|
|
attr->cqe = max_t(uint32_t, HNS_ROCE_MIN_CQE_NUM,
|
|
@@ -556,6 +553,7 @@ static void hns_roce_uninit_cq_swc(struct hns_roce_cq *cq)
|
|
static struct ibv_cq_ex *create_cq(struct ibv_context *context,
|
|
struct ibv_cq_init_attr_ex *attr)
|
|
{
|
|
+ struct hns_roce_pad *pad = to_hr_pad(attr->parent_domain);
|
|
struct hns_roce_context *hr_ctx = to_hr_ctx(context);
|
|
struct hns_roce_cq *cq;
|
|
int ret;
|
|
@@ -570,8 +568,10 @@ static struct ibv_cq_ex *create_cq(struct ibv_context *context,
|
|
goto err;
|
|
}
|
|
|
|
- if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD)
|
|
+ if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD) {
|
|
cq->parent_domain = attr->parent_domain;
|
|
+ atomic_fetch_add(&pad->pd.refcount, 1);
|
|
+ }
|
|
|
|
ret = hns_roce_cq_spinlock_init(context, cq, attr);
|
|
if (ret)
|
|
@@ -611,6 +611,8 @@ err_db:
|
|
err_buf:
|
|
hns_roce_spinlock_destroy(&cq->hr_lock);
|
|
err_lock:
|
|
+ if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD)
|
|
+ atomic_fetch_sub(&pad->pd.refcount, 1);
|
|
free(cq);
|
|
err:
|
|
if (ret < 0)
|
|
@@ -977,6 +979,8 @@ err_destroy_lock:
|
|
hns_roce_spinlock_destroy(&srq->hr_lock);
|
|
|
|
err_free_srq:
|
|
+ if (pad)
|
|
+ atomic_fetch_sub(&pad->pd.refcount, 1);
|
|
free(srq);
|
|
|
|
err:
|
|
@@ -1872,6 +1876,8 @@ err_cmd:
|
|
err_buf:
|
|
hns_roce_qp_spinlock_destroy(qp);
|
|
err_spinlock:
|
|
+ if (pad)
|
|
+ atomic_fetch_sub(&pad->pd.refcount, 1);
|
|
free(qp);
|
|
err:
|
|
if (ret < 0)
|
|
--
|
|
2.25.1
|
|
|