[PATCH for-rc 1/7] RDMA/bnxt_re: Clear stale RCFW resp pointer when wait ends

[Selvin Xavier <selvin.xavier@broadcom.com>]

If the wait ends with ERR_DEVICE_DETACHED, bnxt_qplib_map_rc() returns 0
for destroy-type opcodes, so the caller sees a synthetic success without
a CREQ. is_waiter_alive and resp are left set, resp keeps pointing at
the caller's stack, and a late CREQ is copied into a dead frame.

After the wait, take hwq->lock and, if the slot still holds this
command's response buffer, clear is_waiter_alive and resp. This also
covers the timeout case, where it is only defensive since is_waiter_alive
was already cleared there. Return success without checking evnt->status
when the slot still holds the buffer, since no completion was processed.

Also reset the slot in the completion handler, in the same critical
section that clears is_in_used, so that a second CREQ for the same cookie
cannot be copied into the caller's buffer. With this, resp == evnt under
the lock means no completion was processed.

Clear crsqe->resp when __send_message_no_waiter() takes a slot as well, so
a stale waiter can never match an internal command's slot by its own
response buffer pointer.

Fixes: 3022cc151197 ("RDMA/bnxt_re: Avoid the command wait if firmware is inactive")
Fixes: 691eb7c6110f ("RDMA/bnxt_re: handle command completions after driver detect a timedout")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 26 ++++++++++++++--------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 34d8aa12265d..707687a8f301 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -255,6 +255,7 @@ static void __send_message_no_waiter(struct bnxt_qplib_rcfw *rcfw,
 	 */
 	crsqe->is_internal_cmd = true;
 	crsqe->is_waiter_alive = false;
+	crsqe->resp = NULL;
 	crsqe->is_in_used = true;
 	crsqe->req_size = __get_cmdq_base_cmd_size(msg->req, msg->req_sz);
 
@@ -487,6 +488,7 @@ static int __bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
 {
 	struct creq_qp_event *evnt = (struct creq_qp_event *)msg->resp;
 	struct bnxt_qplib_crsqe *crsqe;
+	bool pending;
 	u16 cookie;
 	int rc;
 	u8 opcode;
@@ -511,15 +513,21 @@ static int __bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
 	else
 		rc = __poll_for_resp(rcfw, cookie);
 
-	if (rc) {
-		spin_lock_bh(&rcfw->cmdq.hwq.lock);
-		crsqe = &rcfw->crsqe_tbl[cookie];
+	spin_lock_bh(&rcfw->cmdq.hwq.lock);
+	crsqe = &rcfw->crsqe_tbl[cookie];
+	pending = false;
+	if (crsqe->resp == evnt) {
+		pending = true;
 		crsqe->is_waiter_alive = false;
-		if (rc == -ENODEV)
-			set_bit(FIRMWARE_STALL_DETECTED, &rcfw->cmdq.flags);
-		spin_unlock_bh(&rcfw->cmdq.hwq.lock);
-		return -ETIMEDOUT;
+		crsqe->resp = NULL;
 	}
+	if (rc == -ENODEV)
+		set_bit(FIRMWARE_STALL_DETECTED, &rcfw->cmdq.flags);
+	spin_unlock_bh(&rcfw->cmdq.hwq.lock);
+	if (rc)
+		return -ETIMEDOUT;
+	if (pending)
+		return 0;
 
 	if (evnt->status) {
 		/* failed with status */
@@ -703,8 +711,8 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
 		is_waiter_alive = crsqe->is_waiter_alive;
 
 		crsqe->req_size = 0;
-		if (!is_waiter_alive)
-			crsqe->resp = NULL;
+		crsqe->resp = NULL;
+		crsqe->is_waiter_alive = false;
 
 		crsqe->is_in_used = false;
 
-- 
2.39.3