[bug report] RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Long Li,

The patch 6dce3468a04c: "RDMA/mana_ib: Add a driver for Microsoft
Azure Network Adapter" from Sep 20, 2022, leads to the following
Smatch static checker warning:

	drivers/infiniband/hw/mana/qp.c:240 mana_ib_create_qp_rss()
	warn: 'mana_ind_table' was already freed.

drivers/infiniband/hw/mana/qp.c
    91 static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
    92                                  struct ib_qp_init_attr *attr,
    93                                  struct ib_udata *udata)
    94 {
    95         struct mana_ib_qp *qp = container_of(ibqp, struct mana_ib_qp, ibqp);
    96         struct mana_ib_dev *mdev =
    97                 container_of(pd->device, struct mana_ib_dev, ib_dev);
    98         struct ib_rwq_ind_table *ind_tbl = attr->rwq_ind_tbl;
    99         struct mana_ib_create_qp_rss_resp resp = {};
    100         struct mana_ib_create_qp_rss ucmd = {};
    101         struct gdma_dev *gd = mdev->gdma_dev;
    102         mana_handle_t *mana_ind_table;
    103         struct mana_port_context *mpc;
    104         struct mana_context *mc;
    105         struct net_device *ndev;
    106         struct mana_ib_cq *cq;
    107         struct mana_ib_wq *wq;
    108         struct ib_cq *ibcq;
    109         struct ib_wq *ibwq;
    110         int i = 0, ret;
    111         u32 port;
    112 
    113         mc = gd->driver_data;
    114 
    115         if (udata->inlen < sizeof(ucmd))
    116                 return -EINVAL;
    117 
    118         ret = ib_copy_from_udata(&ucmd, udata, min(sizeof(ucmd), udata->inlen));
    119         if (ret) {
    120                 ibdev_dbg(&mdev->ib_dev,
    121                           "Failed copy from udata for create rss-qp, err %d\n",
    122                           ret);
    123                 return -EFAULT;
    124         }
    125 
    126         if (attr->cap.max_recv_wr > MAX_SEND_BUFFERS_PER_QUEUE) {
    127                 ibdev_dbg(&mdev->ib_dev,
    128                           "Requested max_recv_wr %d exceeding limit.\n",
    129                           attr->cap.max_recv_wr);
    130                 return -EINVAL;
    131         }
    132 
    133         if (attr->cap.max_recv_sge > MAX_RX_WQE_SGL_ENTRIES) {
    134                 ibdev_dbg(&mdev->ib_dev,
    135                           "Requested max_recv_sge %d exceeding limit.\n",
    136                           attr->cap.max_recv_sge);
    137                 return -EINVAL;
    138         }
    139 
    140         if (ucmd.rx_hash_function != MANA_IB_RX_HASH_FUNC_TOEPLITZ) {
    141                 ibdev_dbg(&mdev->ib_dev,
    142                           "RX Hash function is not supported, %d\n",
    143                           ucmd.rx_hash_function);
    144                 return -EINVAL;
    145         }
    146 
    147         /* IB ports start with 1, MANA start with 0 */
    148         port = ucmd.port;
    149         if (port < 1 || port > mc->num_ports) {
    150                 ibdev_dbg(&mdev->ib_dev, "Invalid port %u in creating qp\n",
    151                           port);
    152                 return -EINVAL;
    153         }
    154         ndev = mc->ports[port - 1];
    155         mpc = netdev_priv(ndev);
    156 
    157         ibdev_dbg(&mdev->ib_dev, "rx_hash_function %d port %d\n",
    158                   ucmd.rx_hash_function, port);
    159 
    160         mana_ind_table = kzalloc(sizeof(mana_handle_t) *
    161                                          (1 << ind_tbl->log_ind_tbl_size),
    162                                  GFP_KERNEL);
    163         if (!mana_ind_table) {
    164                 ret = -ENOMEM;
    165                 goto fail;
    166         }
    167 
    168         qp->port = port;
    169 
    170         for (i = 0; i < (1 << ind_tbl->log_ind_tbl_size); i++) {
    171                 struct mana_obj_spec wq_spec = {};
    172                 struct mana_obj_spec cq_spec = {};
    173 
    174                 ibwq = ind_tbl->ind_tbl[i];
    175                 wq = container_of(ibwq, struct mana_ib_wq, ibwq);
    176 
    177                 ibcq = ibwq->cq;
    178                 cq = container_of(ibcq, struct mana_ib_cq, ibcq);
    179 
    180                 wq_spec.gdma_region = wq->gdma_region;
    181                 wq_spec.queue_size = wq->wq_buf_size;
    182 
    183                 cq_spec.gdma_region = cq->gdma_region;
    184                 cq_spec.queue_size = cq->cqe * COMP_ENTRY_SIZE;
    185                 cq_spec.modr_ctx_id = 0;
    186                 cq_spec.attached_eq = GDMA_CQ_NO_EQ;
    187 
    188                 ret = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_RQ,
    189                                          &wq_spec, &cq_spec, &wq->rx_object);
    190                 if (ret)
    191                         goto fail;
    192 
    193                 /* The GDMA regions are now owned by the WQ object */
    194                 wq->gdma_region = GDMA_INVALID_DMA_REGION;
    195                 cq->gdma_region = GDMA_INVALID_DMA_REGION;
    196 
    197                 wq->id = wq_spec.queue_index;
    198                 cq->id = cq_spec.queue_index;
    199 
    200                 ibdev_dbg(&mdev->ib_dev,
    201                           "ret %d rx_object 0x%llx wq id %llu cq id %llu\n",
    202                           ret, wq->rx_object, wq->id, cq->id);
    203 
    204                 resp.entries[i].cqid = cq->id;
    205                 resp.entries[i].wqid = wq->id;
    206 
    207                 mana_ind_table[i] = wq->rx_object;
    208         }
    209         resp.num_entries = i;
    210 
    211         ret = mana_ib_cfg_vport_steering(mdev, ndev, wq->rx_object,
    212                                          mana_ind_table,
    213                                          ind_tbl->log_ind_tbl_size,
    214                                          ucmd.rx_hash_key_len,
    215                                          ucmd.rx_hash_key);
    216         if (ret)
    217                 goto fail;
    218 
    219         kfree(mana_ind_table);

Freed here.

    220 
    221         if (udata) {
    222                 ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
    223                 if (ret) {
    224                         ibdev_dbg(&mdev->ib_dev,
    225                                   "Failed to copy to udata create rss-qp, %d\n",
    226                                   ret);
    227                         goto fail;

Goto.

    228                 }
    229         }
    230 
    231         return 0;
    232 
    233 fail:
    234         while (i-- > 0) {
    235                 ibwq = ind_tbl->ind_tbl[i];
    236                 wq = container_of(ibwq, struct mana_ib_wq, ibwq);
    237                 mana_destroy_wq_obj(mpc, GDMA_RQ, wq->rx_object);
    238         }
    239 
--> 240         kfree(mana_ind_table);

Double freed.

    241 
    242         return ret;
    243 }

regards,
dan carpenter