Re: [PATCH rdma-next 1/1] RDMA/rxe: Fix rxe_skb_tx_dtor problem

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2025/7/25 18:31, Zhu Yanjun 写道:
> When skb packets are sent out, these skb packets still depends on
> the rxe resources, for example, QP, sk, when these packets are
> destroyed.
> 
> If these rxe resources are released when the skb packets are destroyed,
> the call traces will appear.
> 
> To avoid skb packets hang too long time in some network devices,
> a timestamp is added when these skb packets are created. If these
> skb packets hang too long time in network devices, these network
> devices can free these skb packets to release rxe resources.
> 
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com

In this link 
https://lore.kernel.org/all/c15f999a-7fe1-463a-b9e2-ef145c3afe81@linux.dev/T/#m06e38003c5aa1833e2b24391cef807ae88104cf4,

syzbot confirmed that this commit can fix this problem.

Best Regards,
Zhu Yanjun

> Fixes: 1a633bdc8fd9 ("RDMA/rxe: Let destroy qp succeed with stuck packet")
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> ---
>   drivers/infiniband/sw/rxe/rxe_net.c | 29 ++++++++---------------------
>   drivers/infiniband/sw/rxe/rxe_qp.c  |  2 +-
>   2 files changed, 9 insertions(+), 22 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
> index 132a87e52d5c..ac0183a2ff7a 100644
> --- a/drivers/infiniband/sw/rxe/rxe_net.c
> +++ b/drivers/infiniband/sw/rxe/rxe_net.c
> @@ -345,33 +345,15 @@ int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
>   
>   static void rxe_skb_tx_dtor(struct sk_buff *skb)
>   {
> -	struct net_device *ndev = skb->dev;
> -	struct rxe_dev *rxe;
> -	unsigned int qp_index;
> -	struct rxe_qp *qp;
> +	struct rxe_qp *qp = skb->sk->sk_user_data;
>   	int skb_out;
>   
> -	rxe = rxe_get_dev_from_net(ndev);
> -	if (!rxe && is_vlan_dev(ndev))
> -		rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
> -	if (WARN_ON(!rxe))
> -		return;
> -
> -	qp_index = (int)(uintptr_t)skb->sk->sk_user_data;
> -	if (!qp_index)
> -		return;
> -
> -	qp = rxe_pool_get_index(&rxe->qp_pool, qp_index);
> -	if (!qp)
> -		goto put_dev;
> -
>   	skb_out = atomic_dec_return(&qp->skb_out);
> -	if (qp->need_req_skb && skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)
> +	if (unlikely(qp->need_req_skb &&
> +		skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW))
>   		rxe_sched_task(&qp->send_task);
>   
>   	rxe_put(qp);
> -put_dev:
> -	ib_device_put(&rxe->ib_dev);
>   	sock_put(skb->sk);
>   }
>   
> @@ -383,6 +365,7 @@ static int rxe_send(struct sk_buff *skb, struct rxe_pkt_info *pkt)
>   	sock_hold(sk);
>   	skb->sk = sk;
>   	skb->destructor = rxe_skb_tx_dtor;
> +	rxe_get(pkt->qp);
>   	atomic_inc(&pkt->qp->skb_out);
>   
>   	if (skb->protocol == htons(ETH_P_IP))
> @@ -405,6 +388,7 @@ static int rxe_loopback(struct sk_buff *skb, struct rxe_pkt_info *pkt)
>   	sock_hold(sk);
>   	skb->sk = sk;
>   	skb->destructor = rxe_skb_tx_dtor;
> +	rxe_get(pkt->qp);
>   	atomic_inc(&pkt->qp->skb_out);
>   
>   	if (skb->protocol == htons(ETH_P_IP))
> @@ -497,6 +481,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
>   		goto out;
>   	}
>   
> +	/* Add time stamp to skb. */
> +	skb->tstamp = ktime_get();
> +
>   	skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
>   
>   	/* FIXME: hold reference to this netdev until life of this skb. */
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
> index f2af3e0aef35..95f1c1c2949d 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -244,7 +244,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
>   	err = sock_create_kern(&init_net, AF_INET, SOCK_DGRAM, 0, &qp->sk);
>   	if (err < 0)
>   		return err;
> -	qp->sk->sk->sk_user_data = (void *)(uintptr_t)qp->elem.index;
> +	qp->sk->sk->sk_user_data = qp;
>   
>   	/* pick a source UDP port number for this QP based on
>   	 * the source QPN. this spreads traffic for different QPs