Re: [PATCH rdma-next v10 7/9] RDMA/mana_ib: Poll RC completions using PSN and FSN progress

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] RDMA/mana_ib: stale pending_cqe left on shared CQ in
  mana_remove_qp_from_cqs()
--

commit 806a276151b888efca6e4438e92abdefb2dc1d9e
Author: Konstantin Taranov <kotaranov@microsoft.com>

RDMA/mana_ib: Poll RC completions using PSN and FSN progress

This commit decodes RC receive, armed-PSN, and MMQ completions, retiring
requester and MMQ shadow entries using PSN and FSN progress while honoring
cross-queue fence dependencies and rearming the next signaled PSN.

> diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
> index 843e2c64b32bc..307383bfa4ac7 100644
> --- a/drivers/infiniband/hw/mana/cq.c
> +++ b/drivers/infiniband/hw/mana/cq.c

[ ... ]

> @@ -277,15 +283,18 @@ int mana_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
>  	struct mana_ib_cq *cq = container_of(ibcq, struct mana_ib_cq, ibcq);
>  	struct gdma_queue *gdma_cq = cq->queue.kmem;
>  	unsigned long irq_flags;
> +	bool missed = false;
>  
>  	if (!gdma_cq)
>  		return -EINVAL;
>  
>  	spin_lock_irqsave(&cq->cq_lock, irq_flags);
>  	mana_ib_cq_doorbell(cq, SET_ARM_BIT);
> +	if (flags & IB_CQ_REPORT_MISSED_EVENTS)
> +		missed = cq->has_pending_cqe;
>  	spin_unlock_irqrestore(&cq->cq_lock, irq_flags);
>  
> -	return 0;
> +	return missed;
>  }

[ ... ]

> @@ -390,17 +425,108 @@ static void handle_rq_cqe(struct mana_ib_qp *qp, struct gdma_comp *cqe,
>  	shadow_queue_advance_consumer(&qp->shadow_rq);
>  }

[ ... ]

>  static bool mana_handle_cqe(struct mana_ib_cq *cq, struct mana_ib_dev *mdev,
>  			    struct mana_cq_poll *poll)
>  {
>  	struct gdma_comp *cqe = &cq->pending_cqe;
>  	struct mana_rdma_cqe *rdma_cqe = (struct mana_rdma_cqe *)cqe->cqe_data;
>  	struct mana_ib_qp *qp = mana_get_qp_ref(mdev, cqe->wq_num, cqe->is_sq);
> +	bool consumed = true;
>  
>  	if (!qp)
>  		return true;
>  
>  	switch (rdma_cqe->cqe_type) {
> +	case CQE_TYPE_ARMED_CMPL:
> +		consumed = handle_psn_cqe(qp, rdma_cqe->rc_armed_completion.psn, poll);
> +		break;
> +	case CQE_TYPE_LWR:
> +		consumed = handle_mmq_cqe(qp, rdma_cqe->rc_mm.fsn, poll);
> +		break;

[Severity: Medium]
Can destroying an RC QP leave a stale cq->pending_cqe on a shared CQ when
handle_psn_cqe() or handle_mmq_cqe() hits poll->budget?

When mana_advance_send() exhausts poll->budget, mana_handle_cqe() returns
false and mana_ib_poll_cq() leaves cq->has_pending_cqe set.  If that QP is
then destroyed before the remaining WQEs are polled, mana_ib_arm_cq() with
IB_CQ_REPORT_MISSED_EVENTS falsely reports a missed event, and if the
hardware queue ID is reused by a new QP before the next poll,
mana_ib_poll_cq() will process the destroyed QP's pending_cqe against the
new QP and prematurely retire its shadow WQEs.

Follow-up commit "RDMA/mana_ib: Handle error CQEs for kernel QPs" in this
series adds mana_ib_cq_clean() to mana_remove_qp_from_cqs(), but only
under if (reset), so mana_ib_destroy_rc_qp() calling
mana_remove_qp_from_cqs(qp, false) still leaves the destroyed QP's
pending_cqe and unpolled CQEs on the shared CQ.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111121417.1265896-1-kotaranov@linux.microsoft.com?part=7