From: Jason Gunthorpe <jgg@nvidia.com>
To: Shifeng Li <lishifeng@sangfor.com.cn>
Cc: mustafa.ismail@intel.com, shiraz.saleem@intel.com,
leon@kernel.org, gustavoars@kernel.org,
linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org,
dinghui@sangfor.com.cn, lishifeng1992@126.com
Subject: Re: [PATCH v2] RDMA/irdma: Avoid free the non-cqp_request scratch
Date: Mon, 4 Dec 2023 20:06:32 -0400 [thread overview]
Message-ID: <20231205000632.GA2771679@nvidia.com> (raw)
In-Reply-To: <20231130081415.891006-1-lishifeng@sangfor.com.cn>
On Thu, Nov 30, 2023 at 12:14:15AM -0800, Shifeng Li wrote:
> When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as
> a cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when
> removing the irdma driver or unplugging its aux device, cqp.sc_cqp
> will be dereferenced as wrong struct in irdma_free_pending_cqp_request().
>
> crash> bt 3669
> PID: 3669 TASK: ffff88aef892c000 CPU: 28 COMMAND: "kworker/28:0"
> #0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34
> #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2
> #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f
> #3 [fffffe0000549eb8] do_nmi at ffffffff81079582
> #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4
> [exception RIP: native_queued_spin_lock_slowpath+1291]
> RIP: ffffffff8127e72b RSP: ffff88aa841ef778 RFLAGS: 00000046
> RAX: 0000000000000000 RBX: ffff88b01f849700 RCX: ffffffff8127e47e
> RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff83857ec0
> RBP: ffff88afe3e4efc8 R8: ffffed15fc7c9dfa R9: ffffed15fc7c9dfa
> R10: 0000000000000001 R11: ffffed15fc7c9df9 R12: 0000000000740000
> R13: ffff88b01f849708 R14: 0000000000000003 R15: ffffed1603f092e1
> ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
> --- <NMI exception stack> ---
> #5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b
> #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4
> #7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363
> #8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma]
> #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma]
> #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma]
> #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma]
> #12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb
> #13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6
> #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278
> #15 [ffff88aa841efb88] device_del at ffffffff82179d23
> #16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice]
> #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice]
> #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a
> #19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff
> #20 [ffff88aa841eff10] kthread at ffffffff811d87a0
> #21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f
>
> Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions")
> Suggested-by: Leon Romanovsky <leon@kernel.org>
> Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
> Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
> ---
> drivers/infiniband/hw/irdma/hw.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
Applied to for-rc, thanks
Jason
prev parent reply other threads:[~2023-12-05 0:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-30 8:14 [PATCH v2] RDMA/irdma: Avoid free the non-cqp_request scratch Shifeng Li
2023-11-30 8:34 ` Shifeng Li
2023-11-30 15:46 ` Saleem, Shiraz
2023-12-05 0:06 ` Jason Gunthorpe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231205000632.GA2771679@nvidia.com \
--to=jgg@nvidia.com \
--cc=dinghui@sangfor.com.cn \
--cc=gustavoars@kernel.org \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=lishifeng1992@126.com \
--cc=lishifeng@sangfor.com.cn \
--cc=mustafa.ismail@intel.com \
--cc=shiraz.saleem@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.