Re: [PATCH rdma-next 09/10] RDMA/mana_ib: Handle error CQEs for RC QPs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/mana_ib: module unload race due to missing workqueue teardown
--

commit a138de6b28986049d5aed34daaeffc27d848b82d
Author: Konstantin Taranov <kotaranov@microsoft.com>

RDMA/mana_ib: Handle error CQEs for RC QPs

Decode hardware error CQEs and process them on the corresponding work
queue. Complete the failing shadow entry with the vendor status from
the CQE.

Defer transitioning RC QPs to the ERR state so that the other work
queues can be flushed.

> diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
> index b3891956f0666..0f60909cbe848 100644
> --- a/drivers/infiniband/hw/mana/qp.c
> +++ b/drivers/infiniband/hw/mana/qp.c

[ ... ]

> @@ -1136,6 +1139,20 @@ int mana_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
>  	return ret;
>  }
>  
> +static void mana_ib_qp_error_work(struct work_struct *work)
> +{
> +	struct mana_ib_qp *qp = container_of(work, struct mana_ib_qp, error_work);
> +	struct ib_qp_attr attr = { .qp_state = IB_QPS_ERR };
> +	int ret;
> +
> +	ret = mana_ib_modify_qp(&qp->ibqp, &attr, IB_QP_STATE, NULL);
> +	if (ret)
> +		ibdev_err(qp->ibqp.device, "Failed to move QP %u to ERR: %d\n",
> +			  qp->ibqp.qp_num, ret);
> +
> +	mana_put_qp_ref(qp);
> +}

[Severity: High]
Does this create a race condition with module unload?

If the QP destruction path waits on wait_for_completion(&qp->free) and
proceeds immediately after mana_put_qp_ref() drops the refcount, the
teardown can complete and the module can be unloaded before the worker
thread finishes returning.

If the worker thread is preempted right after signaling the completion in
mana_put_qp_ref(), it could later resume execution and attempt to return
into potentially unmapped module memory, causing a kernel panic.

Should the teardown path explicitly flush or cancel the queued work instead
of relying solely on refcounting for synchronization?

> +
>  static int mana_ib_destroy_qp_rss(struct mana_ib_qp *qp,
>  				  struct ib_rwq_ind_table *ind_tbl,
>  				  struct ib_udata *udata)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001182015.1757203-1-kotaranov@linux.microsoft.com?part=9