[PATCH for-rc v2 0/6] IB/hfi1,rdmavt: Fixes for the 4.17 RC

[PATCH for-rc v2 0/6] IB/hfi1,rdmavt: Fixes for the 4.17 RC

[Dennis Dalessandro]

Hi Jason and Doug,

Here are 6 patches that might make the bar for RC. The first patch fixes
something that came in pretty recently, I beleive 4.13. The second patch is
trivial, but does modify user visible text.

Patch 3 looks large but it's mostly comments. It just moves code. Patch 4 is
also pretty simple. The last two patches fix memory leaks.

If you don't think these pass muster for RC please carry over to for-next.

Changes since V1:
Correct version tag so it shows up as for-rc in patchworks. 

---

Michael J. Ruhl (1):
      IB/hfi1 Use correct type for num_user_context

Mike Marciniszyn (2):
      IB/hfi1: Fix handling of FECN marked multicast packet
      IB/hfi1: Fix loss of BECN with AHG

Sebastian Sanchez (3):
      IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
      IB/{hfi1,rdmavt}: Fix memory leak in hfi1_alloc_devdata() upon failure
      IB/hfi1: Fix memory leak in exception path in get_irq_affinity()


 drivers/infiniband/hw/hfi1/affinity.c |   11 +++----
 drivers/infiniband/hw/hfi1/driver.c   |   19 ++++++++++---
 drivers/infiniband/hw/hfi1/hfi.h      |    8 +++--
 drivers/infiniband/hw/hfi1/init.c     |   43 ++++++++++++++++++++--------
 drivers/infiniband/hw/hfi1/pcie.c     |    3 --
 drivers/infiniband/hw/hfi1/platform.c |    1 +
 drivers/infiniband/hw/hfi1/qsfp.c     |    2 +
 drivers/infiniband/hw/hfi1/ruc.c      |   50 ++++++++++++++++++++++++++-------
 drivers/infiniband/hw/hfi1/ud.c       |    6 ++--
 9 files changed, 101 insertions(+), 42 deletions(-)

[PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Dennis Dalessandro]

From: Mike Marciniszyn <mike.marciniszyn@intel.com>

The code for handling a marked UD packet unconditionally returns the
dlid in the header of the FECN marked packet.  This is not correct
for multicast packets where the DLID is in the multicast range.

The subsequent attempt to send the CNP with the multicast lid will
cause the chip to halt the ack send context because the source
lid doesn't match the chip programming.   The send context will
be halted and flush any other pending packets in the pio ring causing
the CNP to not be sent.

A part of investigating the fix, it was determined that the 16B work
broke the FECN routine badly with inconsistent use of 16 bit and 32 bits
types for lids and pkeys.  Since the port's source lid was correctly 32
bits the type mixmatches need to be dealt with at the same time as
fixing the CNP header issue.

Fix these issues by:
- Using the ports lid for as the SLID for responding to FECN marked UD
  packets
- Insure pkey is always 16 bit in this and subordinate routines
- Insure lids are 32 bits in this and subordinate routines

Cc: <stable@vger.kernel.org> # 4.14.x
Fixes: 88733e3b8450 ("IB/hfi1: Add 16B UD support")
Reviewed-by: Don Hiatt <don.hiatt@intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
---
 drivers/infiniband/hw/hfi1/driver.c |   19 +++++++++++++++----
 drivers/infiniband/hw/hfi1/hfi.h    |    8 ++++----
 drivers/infiniband/hw/hfi1/ud.c     |    6 +++---
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 46d1475..bd837a0 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -433,31 +433,43 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
 			       bool do_cnp)
 {
 	struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
 	struct ib_other_headers *ohdr = pkt->ohdr;
 	struct ib_grh *grh = pkt->grh;
 	u32 rqpn = 0, bth1;
-	u16 pkey, rlid, dlid = ib_get_dlid(pkt->hdr);
+	u16 pkey;
+	u32 rlid, slid, dlid = 0;
 	u8 hdr_type, sc, svc_type;
 	bool is_mcast = false;
 
+	/* can be called from prescan */
 	if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
 		is_mcast = hfi1_is_16B_mcast(dlid);
 		pkey = hfi1_16B_get_pkey(pkt->hdr);
 		sc = hfi1_16B_get_sc(pkt->hdr);
+		dlid = hfi1_16B_get_dlid(pkt->hdr);
+		slid = hfi1_16B_get_slid(pkt->hdr);
 		hdr_type = HFI1_PKT_TYPE_16B;
 	} else {
 		is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
 			   (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
 		pkey = ib_bth_get_pkey(ohdr);
 		sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+		dlid = ib_get_dlid(pkt->hdr);
+		slid = ib_get_slid(pkt->hdr);
 		hdr_type = HFI1_PKT_TYPE_9B;
 	}
 
 	switch (qp->ibqp.qp_type) {
+	case IB_QPT_UD:
+		dlid = ppd->lid;
+		rlid = slid;
+		rqpn = ib_get_sqpn(pkt->ohdr);
+		svc_type = IB_CC_SVCTYPE_UD;
+		break;
 	case IB_QPT_SMI:
 	case IB_QPT_GSI:
-	case IB_QPT_UD:
-		rlid = ib_get_slid(pkt->hdr);
+		rlid = slid;
 		rqpn = ib_get_sqpn(pkt->ohdr);
 		svc_type = IB_CC_SVCTYPE_UD;
 		break;
@@ -482,7 +494,6 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
 					      dlid, rlid, sc, grh);
 
 	if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
-		struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
 		u32 lqpn = bth1 & RVT_QPN_MASK;
 		u8 sl = ibp->sc_to_sl[sc];
 
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 32c4826..cac2c62 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1537,13 +1537,13 @@ static inline u32 egress_cycles(u32 len, u32 rate)
 void process_becn(struct hfi1_pportdata *ppd, u8 sl, u32 rlid, u32 lqpn,
 		  u32 rqpn, u8 svc_type);
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-		u32 pkey, u32 slid, u32 dlid, u8 sc5,
+		u16 pkey, u32 slid, u32 dlid, u8 sc5,
 		const struct ib_grh *old_grh);
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-		    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+		    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
 		    u8 sc5, const struct ib_grh *old_grh);
 typedef void (*hfi1_handle_cnp)(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-				u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+				u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
 				u8 sc5, const struct ib_grh *old_grh);
 
 #define PKEY_CHECK_INVALID -1
@@ -2437,7 +2437,7 @@ static inline void hfi1_make_16b_hdr(struct hfi1_16b_header *hdr,
 		((slid >> OPA_16B_SLID_SHIFT) << OPA_16B_SLID_HIGH_SHIFT);
 	lrh2 = (lrh2 & ~OPA_16B_DLID_MASK) |
 		((dlid >> OPA_16B_DLID_SHIFT) << OPA_16B_DLID_HIGH_SHIFT);
-	lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | (pkey << OPA_16B_PKEY_SHIFT);
+	lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | ((u32)pkey << OPA_16B_PKEY_SHIFT);
 	lrh2 = (lrh2 & ~OPA_16B_L4_MASK) | l4;
 
 	hdr->lrh[0] = lrh0;
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index bcf3b0b..49a38a6 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -628,7 +628,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibport *ibp, u16 pkey)
 }
 
 void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
-		    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
+		    u32 remote_qpn, u16 pkey, u32 slid, u32 dlid,
 		    u8 sc5, const struct ib_grh *old_grh)
 {
 	u64 pbc, pbc_flags = 0;
@@ -687,7 +687,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 }
 
 void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
-		u32 pkey, u32 slid, u32 dlid, u8 sc5,
+		u16 pkey, u32 slid, u32 dlid, u8 sc5,
 		const struct ib_grh *old_grh)
 {
 	u64 pbc, pbc_flags = 0;
@@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
 
 	lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
 
-	bth0 = pkey | (IB_OPCODE_CNP << 24);
+	bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
 	ohdr->bth[0] = cpu_to_be32(bth0);
 
 	ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));

Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Jason Gunthorpe]

On Tue, May 01, 2018 at 05:35:36AM -0700, Dennis Dalessandro wrote:
> @@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
>  
>  	lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
>  
> -	bth0 = pkey | (IB_OPCODE_CNP << 24);
> +	bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);

What do you think this cast does??

void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
                    u32 remote_qpn, u32 pkey, u32 slid, u32 dlid,
                    u8 sc5, const struct ib_grh *old_grh)
{


Jason

RE: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Marciniszyn, Mike]

> Subject: Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked
> multicast packet
> 
> On Tue, May 01, 2018 at 05:35:36AM -0700, Dennis Dalessandro wrote:
> > @@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct
> rvt_qp *qp, u32 remote_qpn,
> >
> >  	lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
> >
> > -	bth0 = pkey | (IB_OPCODE_CNP << 24);
> > +	bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
> 

I'm verifying the fix w/o the cast...

But I see Doug pulled the fix?

Mike

Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Doug Ledford]

[-- Attachment #1: Type: text/plain, Size: 866 bytes --]

On Tue, 2018-05-01 at 21:58 +0000, Marciniszyn, Mike wrote:
> > Subject: Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked
> > multicast packet
> > 
> > On Tue, May 01, 2018 at 05:35:36AM -0700, Dennis Dalessandro wrote:
> > > @@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct
> > 
> > rvt_qp *qp, u32 remote_qpn,
> > > 
> > >  	lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
> > > 
> > > -	bth0 = pkey | (IB_OPCODE_CNP << 24);
> > > +	bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
> 
> I'm verifying the fix w/o the cast...
> 
> But I see Doug pulled the fix?

It's in my wip branch, so until I merge it into the official for-rc
branch, I can still fix up minor things like this.

-- 
Doug Ledford <dledford@redhat.com>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

RE: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Marciniszyn, Mike]

> >
> > But I see Doug pulled the fix?
> 
> It's in my wip branch, so until I merge it into the official for-rc
> branch, I can still fix up minor things like this.
> 

The patch works without the cast.

How do you want to do this:
- A v2 -> v3 of the patch?
- Manually delete the cast in your wip branch?

Here is the diff hunk for removing the cast from return_cnp:
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 9aa7d87..6ad203f 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,

        lrh0 |= (sc5 & 0xf) << 12 | sl << 4;

-       bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
+       bth0 = pkey | (IB_OPCODE_CNP << 24);
        ohdr->bth[0] = cpu_to_be32(bth0);

        ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));

Mike

Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Doug Ledford]

[-- Attachment #1.1: Type: text/plain, Size: 1126 bytes --]

On 5/3/2018 8:54 AM, Marciniszyn, Mike wrote:
>>>
>>> But I see Doug pulled the fix?
>>
>> It's in my wip branch, so until I merge it into the official for-rc
>> branch, I can still fix up minor things like this.
>>
> 
> The patch works without the cast.
> 
> How do you want to do this:
> - A v2 -> v3 of the patch?
> - Manually delete the cast in your wip branch?
> 
> Here is the diff hunk for removing the cast from return_cnp:
> diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
> index 9aa7d87..6ad203f 100644
> --- a/drivers/infiniband/hw/hfi1/ud.c
> +++ b/drivers/infiniband/hw/hfi1/ud.c
> @@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
> 
>         lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
> 
> -       bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
> +       bth0 = pkey | (IB_OPCODE_CNP << 24);
>         ohdr->bth[0] = cpu_to_be32(bth0);
> 
>         ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));
> 
> Mike
> 

I'll manually delete it in my WIP.  Thanks for getting the test results
back :-)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 898 bytes --]

Re: [PATCH for-rc v2 1/6] IB/hfi1: Fix handling of FECN marked multicast packet

[Doug Ledford]

[-- Attachment #1: Type: text/plain, Size: 1436 bytes --]

On Thu, 2018-05-03 at 15:08 -0400, Doug Ledford wrote:
> On 5/3/2018 8:54 AM, Marciniszyn, Mike wrote:
> > > > 
> > > > But I see Doug pulled the fix?
> > > 
> > > It's in my wip branch, so until I merge it into the official for-rc
> > > branch, I can still fix up minor things like this.
> > > 
> > 
> > The patch works without the cast.
> > 
> > How do you want to do this:
> > - A v2 -> v3 of the patch?
> > - Manually delete the cast in your wip branch?
> > 
> > Here is the diff hunk for removing the cast from return_cnp:
> > diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
> > index 9aa7d87..6ad203f 100644
> > --- a/drivers/infiniband/hw/hfi1/ud.c
> > +++ b/drivers/infiniband/hw/hfi1/ud.c
> > @@ -719,7 +719,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
> > 
> >         lrh0 |= (sc5 & 0xf) << 12 | sl << 4;
> > 
> > -       bth0 = (u32)pkey | (IB_OPCODE_CNP << 24);
> > +       bth0 = pkey | (IB_OPCODE_CNP << 24);
> >         ohdr->bth[0] = cpu_to_be32(bth0);
> > 
> >         ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));
> > 
> > Mike
> > 
> 
> I'll manually delete it in my WIP.  Thanks for getting the test results
> back :-)
> 

Fixed in WIP, thanks.

-- 
Doug Ledford <dledford@redhat.com>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH for-rc v2 3/6] IB/hfi1: Fix loss of BECN with AHG

[Dennis Dalessandro]

From: Mike Marciniszyn <mike.marciniszyn@intel.com>

AHG may be armed to use the stored header, which by design is limited
to edits in the PSN/A 32 bit word (bth2).

When the code is trying to send a BECN, the use of the stored header
will lose the BECN bit.

Fix by avoiding AHG when getting ready to send a BECN. This is
accomplished by always claiming the packet is not a middle packet which
is an AHG precursor.  BECNs are not a normal case and this should not
hurt AHG optimizations.

Cc: <stable@vger.kernel.org> # 4.14.x
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
---
 drivers/infiniband/hw/hfi1/ruc.c |   50 ++++++++++++++++++++++++++++++--------
 1 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
index 3daa94b..c0071ca 100644
--- a/drivers/infiniband/hw/hfi1/ruc.c
+++ b/drivers/infiniband/hw/hfi1/ruc.c
@@ -733,6 +733,20 @@ static inline void hfi1_make_ruc_bth(struct rvt_qp *qp,
 	ohdr->bth[2] = cpu_to_be32(bth2);
 }
 
+/**
+ * hfi1_make_ruc_header_16B - build a 16B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
 					    struct ib_other_headers *ohdr,
 					    u32 bth0, u32 bth2, int middle,
@@ -777,6 +791,12 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
 	else
 		middle = 0;
 
+	if (qp->s_flags & RVT_S_ECN) {
+		qp->s_flags &= ~RVT_S_ECN;
+		/* we recently received a FECN, so return a BECN */
+		becn = true;
+		middle = 0;
+	}
 	if (middle)
 		build_ahg(qp, bth2);
 	else
@@ -784,11 +804,6 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
 
 	bth0 |= pkey;
 	bth0 |= extra_bytes << 20;
-	if (qp->s_flags & RVT_S_ECN) {
-		qp->s_flags &= ~RVT_S_ECN;
-		/* we recently received a FECN, so return a BECN */
-		becn = true;
-	}
 	hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
 
 	if (!ppd->lid)
@@ -806,6 +821,20 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp,
 			  pkey, becn, 0, l4, priv->s_sc);
 }
 
+/**
+ * hfi1_make_ruc_header_9B - build a 9B header
+ * @qp: the queue pair
+ * @ohdr: a pointer to the destination header memory
+ * @bth0: bth0 passed in from the RC/UC builder
+ * @bth2: bth2 passed in from the RC/UC builder
+ * @middle: non zero implies indicates ahg "could" be used
+ * @ps: the current packet state
+ *
+ * This routine may disarm ahg under these situations:
+ * - packet needs a GRH
+ * - BECN needed
+ * - migration state not IB_MIG_MIGRATED
+ */
 static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
 					   struct ib_other_headers *ohdr,
 					   u32 bth0, u32 bth2, int middle,
@@ -839,6 +868,12 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
 	else
 		middle = 0;
 
+	if (qp->s_flags & RVT_S_ECN) {
+		qp->s_flags &= ~RVT_S_ECN;
+		/* we recently received a FECN, so return a BECN */
+		bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
+		middle = 0;
+	}
 	if (middle)
 		build_ahg(qp, bth2);
 	else
@@ -846,11 +881,6 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp,
 
 	bth0 |= pkey;
 	bth0 |= extra_bytes << 20;
-	if (qp->s_flags & RVT_S_ECN) {
-		qp->s_flags &= ~RVT_S_ECN;
-		/* we recently received a FECN, so return a BECN */
-		bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT);
-	}
 	hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2);
 	hfi1_make_ib_hdr(&ps->s_txreq->phdr.hdr.ibh,
 			 lrh0,

[PATCH for-rc v2 4/6] IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used

[Dennis Dalessandro]

From: Sebastian Sanchez <sebastian.sanchez@intel.com>

When an invalid num_vls is used as a module parameter, the code
execution follows an exception path where the macro dd_dev_err()
expects dd->pcidev->dev not to be NULL in hfi1_init_dd(). This
causes a NULL pointer dereference.

Fix hfi1_init_dd() by initializing dd->pcidev and dd->pcidev->dev
earlier in the code. If a dd exists, then dd->pcidev and
dd->pcidev->dev always exists.

BUG: unable to handle kernel NULL pointer dereference
at 00000000000000f0
IP: __dev_printk+0x15/0x90
Workqueue: events work_for_cpu_fn
RIP: 0010:__dev_printk+0x15/0x90
Call Trace:
 dev_err+0x6c/0x90
 ? hfi1_init_pportdata+0x38d/0x3f0 [hfi1]
 hfi1_init_dd+0xdd/0x2530 [hfi1]
 ? pci_conf1_read+0xb2/0xf0
 ? pci_read_config_word.part.9+0x64/0x80
 ? pci_conf1_write+0xb0/0xf0
 ? pcie_capability_clear_and_set_word+0x57/0x80
 init_one+0x141/0x490 [hfi1]
 local_pci_probe+0x3f/0xa0
 work_for_cpu_fn+0x10/0x20
 process_one_work+0x152/0x350
 worker_thread+0x1cf/0x3e0
 kthread+0xf5/0x130
 ? max_active_store+0x80/0x80
 ? kthread_bind+0x10/0x10
 ? do_syscall_64+0x6e/0x1a0
 ? SyS_exit_group+0x10/0x10
 ret_from_fork+0x35/0x40

Cc: <stable@vger.kernel.org> # 4.9.x
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Sebastian Sanchez <sebastian.sanchez@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
---
 drivers/infiniband/hw/hfi1/init.c |    2 ++
 drivers/infiniband/hw/hfi1/pcie.c |    3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index c45cca5..b417e3b 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1265,6 +1265,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra)
 		return ERR_PTR(-ENOMEM);
 	dd->num_pports = nports;
 	dd->pport = (struct hfi1_pportdata *)(dd + 1);
+	dd->pcidev = pdev;
+	pci_set_drvdata(pdev, dd);
 
 	INIT_LIST_HEAD(&dd->list);
 	idr_preload(GFP_KERNEL);
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 83d66e8..c1c9829 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
 	resource_size_t addr;
 	int ret = 0;
 
-	dd->pcidev = pdev;
-	pci_set_drvdata(pdev, dd);
-
 	addr = pci_resource_start(pdev, 0);
 	len = pci_resource_len(pdev, 0);
 

Re: [PATCH for-rc v2 0/6] IB/hfi1,rdmavt: Fixes for the 4.17 RC

[Doug Ledford]

[-- Attachment #1: Type: text/plain, Size: 826 bytes --]

On Tue, 2018-05-01 at 05:35 -0700, Dennis Dalessandro wrote:
> Hi Jason and Doug,
> 
> Here are 6 patches that might make the bar for RC. The first patch fixes
> something that came in pretty recently, I beleive 4.13. The second patch is
> trivial, but does modify user visible text.
> 
> Patch 3 looks large but it's mostly comments. It just moves code. Patch 4 is
> also pretty simple. The last two patches fix memory leaks.
> 
> If you don't think these pass muster for RC please carry over to for-next.
> 
> Changes since V1:
> Correct version tag so it shows up as for-rc in patchworks. 

Those were all reasonable -rc fixes, so applied to for-rc.  Thanks.

-- 
Doug Ledford <dledford@redhat.com>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]