Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"

This reverts commit 7c4a539ec38f4ce400a0f3fcb5ff6c940fcd67bb. which causes
to the following error in mlx4.

Destroy of kernel CQ shouldn't fail
WARNING: CPU: 4 PID: 18064 at include/rdma/ib_verbs.h:3936 mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
Modules linked in: bonding ib_ipoib ip_gre ipip tunnel4 geneve rdma_ucm nf_tables ib_umad mlx4_en mlx4_ib ib_uverbs mlx4_core ip6_gre gre ip6_tunnel tunnel6 iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay fuse [last unloaded: mlx4_core]
CPU: 4 PID: 18064 Comm: ibv_xsrq_pingpo Not tainted 5.17.0-rc7_master_62c6ecb #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
Code: 1e 93 08 00 40 80 fd 01 0f 87 fa f1 04 00 83 e5 01 0f 85 2b ff ff ff 48 c7 c7 20 4f b6 a0 c6 05 fd 92 08 00 01 e8 47 c9 82 e2 <0f> 0b e9 11 ff ff ff 0f b6 2d eb 92 08 00 40 80 fd 01 0f 87 b1 f1
RSP: 0018:ffff8881a4957750 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8881ac4b6800 RCX: 0000000000000000
RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed103492aedc
RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2e378eb
R10: ffffed109a5c6f1d R11: 0000000000000001 R12: ffff888132620000
R13: ffff8881a4957a90 R14: ffff8881aa2d4000 R15: ffff8881a4957ad0
FS: 00007f0401747740(0000) GS:ffff8884d2e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f8ae036118 CR3: 000000012fe94005 CR4: 0000000000370ea0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ib_dealloc_xrcd_user+0xce/0x120 [ib_core]
ib_uverbs_dealloc_xrcd+0xad/0x210 [ib_uverbs]
uverbs_free_xrcd+0xe8/0x190 [ib_uverbs]
destroy_hw_idr_uobject+0x7a/0x130 [ib_uverbs]
uverbs_destroy_uobject+0x164/0x730 [ib_uverbs]
uobj_destroy+0x72/0xf0 [ib_uverbs]
ib_uverbs_cmd_verbs+0x19fb/0x3110 [ib_uverbs]
ib_uverbs_ioctl+0x169/0x260 [ib_uverbs]
__x64_sys_ioctl+0x856/0x1550
do_syscall_64+0x3d/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 7c4a539ec38f ("RDMA/core: Fix ib_qp_usecnt_dec() called when error")
Link: https://lore.kernel.org/r/74c11029adaf449b3b9228a77cc82f39e9e892c8.1646851220.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

authored by

Leon Romanovsky and committed by
Jason Gunthorpe
7922d3de aaaf62e0

+4 -1
+1
drivers/infiniband/core/uverbs_cmd.c
··· 1437 1437 ret = PTR_ERR(qp); 1438 1438 goto err_put; 1439 1439 } 1440 + ib_qp_usecnt_inc(qp); 1440 1441 1441 1442 obj->uevent.uobject.object = qp; 1442 1443 obj->uevent.event_file = READ_ONCE(attrs->ufile->default_async_file);
+1
drivers/infiniband/core/uverbs_std_types_qp.c
··· 254 254 ret = PTR_ERR(qp); 255 255 goto err_put; 256 256 } 257 + ib_qp_usecnt_inc(qp); 257 258 258 259 if (attr.qp_type == IB_QPT_XRC_TGT) { 259 260 obj->uxrcd = container_of(xrcd_uobj, struct ib_uxrcd_object,
+2 -1
drivers/infiniband/core/verbs.c
··· 1245 1245 if (ret) 1246 1246 goto err_security; 1247 1247 1248 - ib_qp_usecnt_inc(qp); 1249 1248 rdma_restrack_add(&qp->res); 1250 1249 return qp; 1251 1250 ··· 1344 1345 qp = create_qp(device, pd, qp_init_attr, NULL, NULL, caller); 1345 1346 if (IS_ERR(qp)) 1346 1347 return qp; 1348 + 1349 + ib_qp_usecnt_inc(qp); 1347 1350 1348 1351 if (qp_init_attr->cap.max_rdma_ctxs) { 1349 1352 ret = rdma_rw_init_mrs(qp, qp_init_attr);