[PATCH rdma-next 10/15] RDMA/mlx5: Set WQ event handler before firmware RQ insertion

[Yishai Hadas <yishaih@nvidia.com>]

mlx5_ib_create_wq() calls create_rq(), which inserts the RQ's
mlx5_core_qp into dev->qp_table.tree via mlx5_core_create_rq_tracked()
-> create_resource_common(), making it immediately visible to
rsc_event_notifier(). rwq->core_qp.event was assigned only after
create_rq() returned, and after several more steps (wq_num/state setup,
ib_respond_udata()), leaving a wide window where a firmware
WQ_CATAS_ERROR EQE would find rwq->core_qp.event still NULL and hit the
WARN_ON_ONCE(!qp->event) guard in rsc_event_notifier(), dropping the
event instead of delivering it.

Move the assignment right after the mlx5_ib_rwq allocation, before
create_rq() is called. mlx5_ib_wq_event() already null-checks
rwq->ibwq.event_handler before touching it, so setting core_qp.event
early is safe even though ibwq.event_handler is still assigned later.

Fixes: 350d0e4c7e4b ("IB/mlx5: Track asynchronous events on a receive work queue")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
---
 drivers/infiniband/hw/mlx5/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index d4d439ebb595..d8e8a84ff3f1 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -5618,6 +5618,7 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
 		rwq = kzalloc_obj(*rwq);
 		if (!rwq)
 			return ERR_PTR(-ENOMEM);
+		rwq->core_qp.event = mlx5_ib_wq_event;
 		err = prepare_user_rq(pd, init_attr, udata, rwq);
 		if (err)
 			goto err;
@@ -5641,7 +5642,6 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
 			goto err_copy;
 	}
 
-	rwq->core_qp.event = mlx5_ib_wq_event;
 	rwq->ibwq.event_handler = init_attr->event_handler;
 	return &rwq->ibwq;
 
-- 
2.18.1