* [PATCH for-rc 1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation
2026-10-13 14:04 [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes Selvin Xavier
@ 2026-10-13 14:04 ` Selvin Xavier
2026-10-13 8:52 ` sashiko-bot
2026-10-13 14:04 ` [PATCH for-rc 2/2] RDMA/bnxt_re: Unpublish QP table before freeing it Selvin Xavier
2026-10-13 15:11 ` [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes Leon Romanovsky
2 siblings, 1 reply; 6+ messages in thread
From: Selvin Xavier @ 2026-10-13 14:04 UTC (permalink / raw)
To: leon, jgg
Cc: linux-rdma, andrew.gospodarek, kalesh-anakkur.purayil,
Abhishek Mohapatra, Selvin Xavier
From: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>
The QP table size depends on the firmware reported max_qp, so it can
be large and a physically contiguous kzalloc may fail. Use kvzalloc_objs()
and free it with kvfree().
Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
Signed-off-by: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
drivers/infiniband/hw/bnxt_re/qplib_res.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 756f8b5f042a..086cf9fe3920 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -909,7 +909,7 @@ int bnxt_qplib_init_res(struct bnxt_qplib_res *res)
void bnxt_qplib_free_res(struct bnxt_qplib_res *res)
{
- kfree(res->rcfw->qp_tbl);
+ kvfree(res->rcfw->qp_tbl);
bnxt_qplib_free_sgid_tbl(res, &res->sgid_tbl);
bnxt_qplib_free_pd_tbl(&res->pd_tbl);
bnxt_qplib_free_dpi_tbl(res, &res->dpi_tbl);
@@ -926,8 +926,8 @@ int bnxt_qplib_alloc_res(struct bnxt_qplib_res *res, struct net_device *netdev)
/* Allocate one extra to hold the QP1 entries */
rcfw->qp_tbl_size = max_t(u32, BNXT_RE_MAX_QPC_COUNT + 1, dev_attr->max_qp);
- rcfw->qp_tbl = kzalloc_objs(struct bnxt_qplib_qp_node,
- rcfw->qp_tbl_size);
+ rcfw->qp_tbl = kvzalloc_objs(struct bnxt_qplib_qp_node,
+ rcfw->qp_tbl_size);
if (!rcfw->qp_tbl)
return -ENOMEM;
--
2.39.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH for-rc 2/2] RDMA/bnxt_re: Unpublish QP table before freeing it
2026-10-13 14:04 [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes Selvin Xavier
2026-10-13 14:04 ` [PATCH for-rc 1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation Selvin Xavier
@ 2026-10-13 14:04 ` Selvin Xavier
2026-10-13 9:06 ` sashiko-bot
2026-10-13 15:11 ` [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes Leon Romanovsky
2 siblings, 1 reply; 6+ messages in thread
From: Selvin Xavier @ 2026-10-13 14:04 UTC (permalink / raw)
To: leon, jgg
Cc: linux-rdma, andrew.gospodarek, kalesh-anakkur.purayil,
Selvin Xavier
bnxt_re_dev_uninit() frees the QP table before the RCFW channel is
disabled, so the CREQ tasklet can still look up rcfw->qp_tbl while it
is being freed.
Clear rcfw->qp_tbl under tbl_lock before freeing it, and have the QP
error notification handler bail out if the table is gone.
Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 ++++
drivers/infiniband/hw/bnxt_re/qplib_res.c | 10 +++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 9ee0d500436c..34d8aa12265d 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -638,6 +638,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
err_event = (struct creq_qp_error_notification *)qp_event;
qp_id = le32_to_cpu(err_event->xid);
spin_lock(&rcfw->tbl_lock);
+ if (!rcfw->qp_tbl) {
+ spin_unlock(&rcfw->tbl_lock);
+ break;
+ }
tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw);
qp = rcfw->qp_tbl[tbl_indx].qp_handle;
if (!qp) {
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 086cf9fe3920..3faaec28201e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -909,7 +909,15 @@ int bnxt_qplib_init_res(struct bnxt_qplib_res *res)
void bnxt_qplib_free_res(struct bnxt_qplib_res *res)
{
- kvfree(res->rcfw->qp_tbl);
+ struct bnxt_qplib_rcfw *rcfw = res->rcfw;
+ struct bnxt_qplib_qp_node *qp_tbl;
+
+ /* The CREQ tasklet may still be running; unpublish the table first */
+ spin_lock_bh(&rcfw->tbl_lock);
+ qp_tbl = rcfw->qp_tbl;
+ rcfw->qp_tbl = NULL;
+ spin_unlock_bh(&rcfw->tbl_lock);
+ kvfree(qp_tbl);
bnxt_qplib_free_sgid_tbl(res, &res->sgid_tbl);
bnxt_qplib_free_pd_tbl(&res->pd_tbl);
bnxt_qplib_free_dpi_tbl(res, &res->dpi_tbl);
--
2.39.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes
2026-10-13 14:04 [PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes Selvin Xavier
2026-10-13 14:04 ` [PATCH for-rc 1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation Selvin Xavier
2026-10-13 14:04 ` [PATCH for-rc 2/2] RDMA/bnxt_re: Unpublish QP table before freeing it Selvin Xavier
@ 2026-10-13 15:11 ` Leon Romanovsky
2 siblings, 0 replies; 6+ messages in thread
From: Leon Romanovsky @ 2026-10-13 15:11 UTC (permalink / raw)
To: jgg, Selvin Xavier; +Cc: linux-rdma, andrew.gospodarek, kalesh-anakkur.purayil
On Tue, 13 Oct 2026 07:04:25 -0700, Selvin Xavier wrote:
> This series fixes couple issues with the QP table
> allocation/teardown.
>
> Please review and apply
>
> Thanks,
> Selvin Xavier
>
> [...]
Applied, thanks!
[1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation
https://git.kernel.org/rdma/rdma/c/724a39b36af947
[2/2] RDMA/bnxt_re: Unpublish QP table before freeing it
https://git.kernel.org/rdma/rdma/c/978361dd2ccff3
Best regards,
--
Leon Romanovsky <leon@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread