Re: [for-next v3 4/5] RDMA/ionic: add Shared receive queue (SRQ) support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] RDMA/ionic: race condition in ionic_modify_srq allows cached limit to diverge from HW limit
--

commit 697ed1cd8f63e63fe464892e9bc1d1c9a1b2de14
Author: Amit Kumar <a.k@amd.com>

RDMA/ionic: add Shared receive queue (SRQ) support

This commit adds Shared receive queue (SRQ) support for the ionic RDMA
driver. It implements the device-supported verb APIs for shared receive
queues, which are currently only supported for userspace.

> diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
> index 3739c1855a4ba..fd15d9549ac04 100644
> --- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
> +++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c

[ ... ]

> +int ionic_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
> +		     enum ib_srq_attr_mask attr_mask, struct ib_udata *udata)
> +{
> +	struct ionic_ibdev *dev = to_ionic_ibdev(ibsrq->device);
> +	struct ionic_srq *srq = to_ionic_srq(ibsrq);
> +	int rc;
> +
> +	if (attr_mask & IB_SRQ_MAX_WR)
> +		return -EINVAL;
> +
> +	if (attr_mask & IB_SRQ_LIMIT) {
> +		if (attr->srq_limit >= IONIC_MAX_SRQ_LIMIT)
> +			return -EINVAL;
> +
> +		rc = ionic_modify_srq_cmd(dev, srq->rq.qid, attr->srq_limit);
> +		if (rc)
> +			return rc;
> +
> +		srq->srq_limit = attr->srq_limit;

[Severity: Medium]
Does this code allow the cached SRQ limit to diverge from the hardware
limit due to a race condition?

In drivers/infiniband/hw/ionic/ionic_controlpath.c, ionic_modify_srq() is
called to update the SRQ limit. The IB core allows concurrent readers via
uobj_get_obj_read(), meaning multiple userspace threads can invoke this
function on the same SRQ object simultaneously.

Because there is no driver-level locking around the hardware command and
the subsequent state update, these operations can interleave. This can result
in the hardware being programmed with one limit while the driver caches a
different limit, causing ibv_query_srq() to return incorrect state to the
user application.

Could a lock be used to protect the SRQ limit modification sequence?

> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925082802.2675902-1-abhijit.gangurde@amd.com?part=4