Re: [PATCH rdma-next v2 07/10] RDMA/mana_ib: Poll RC completions using PSN and FSN progress

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/mana_ib: unmasked 25-bit PSN passed to hardware doorbell
--

commit 19943f505ee2f816323601ebe8474e1ded5ddb62
Author: Konstantin Taranov <kotaranov@microsoft.com>

    RDMA/mana_ib: Poll RC completions using PSN and FSN progress

    Decode RC receive completions, armed-PSN notifications, and MMQ
    completions. Retire requester and MMQ shadow entries using their
    sequence numbers, honor cross-queue fence dependencies, and suppress
    successful WCs for unsignaled work requests.

> diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
> --- a/drivers/infiniband/hw/mana/cq.c
> +++ b/drivers/infiniband/hw/mana/cq.c

[ ... ]

> @@ -390,17 +422,104 @@ static void handle_rq_cqe(struct mana_ib_qp *qp, struct gdma_comp *cqe,

[ ... ]

> +static bool handle_psn_cqe(struct mana_ib_qp *qp, u32 psn,
> +			   struct mana_cq_poll *poll)
> +{
> +	struct mana_ib_dev *mdev = container_of(qp->ibqp.device, struct mana_ib_dev, ib_dev);
> +	struct shadow_wqe_header *shadow_wqe;
> +	struct gdma_queue *recv_q;
> +	bool consumed;
> +	u32 arm_psn;
> +
> +	if (qp->ibqp.qp_type != IB_QPT_RC)
> +		return true;
> +
> +	recv_q = qp->rc_qp.queues[MANA_RC_RECV_QUEUE_REQUESTER].kmem;
> +
> +	consumed = mana_advance_send(qp, false, psn, poll);
> +	if (consumed) {
> +		shadow_wqe = shadow_queue_get_next_to_signal(&qp->shadow_sq);
> +		arm_psn = shadow_wqe ? shadow_wqe->wqe_offset_or_psn : psn + 1;
> +		mana_gd_wq_ring_doorbell_ext(mdev_to_gc(mdev), recv_q, arm_psn,
> +					     SET_ARM_BIT, MANA_PSN_CLIENT_OFFSET);

[Severity: High]
Does this code allow an unmasked 25-bit PSN to be passed to the hardware
doorbell?

If a packet with a PSN of 0xFFFFFF completes and there are no pending signaled
WQEs, shadow_wqe will be NULL, and psn + 1 will evaluate to 0x1000000.

This could cause arm_psn to be set to 0x1000000, which is then passed to
mana_gd_wq_ring_doorbell_ext() and written into the 32-bit tail_ptr field
of the hardware doorbell register.

Could this stall a long-running RC connection and cause it to fail to receive
completions when its PSN wraps? Any application transferring enough data to wrap
the 24-bit PSN (approximately 16 million packets) might trigger this behavior.

> +	}
> +
> +	return consumed;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261003064037.2092669-1-kotaranov@linux.microsoft.com?part=7