[PATCH rdma-next 4/4] RDMA/irdma: Release SRQ slots during CQ scrub

[Jacob Moroni <jmoroni@google.com>]

When the CQ is scrubbed during QP destroy, any unpolled SRQ
completions are invalidated, which causes those SRQ slots to
be leaked because the SRQ tail only advances when completions
are polled.

Fix this by releasing the SRQ slots whenever an SRQ CQE is scrubbed
during QP destroy as well as during the small window prior to CQ
scrub where the QP is marked as "destroy_pending".

In practice, the leak only matters if a consumer posts new buffers
to replace the ones tied to the discarded completions, but releasing
the slots keeps the driver's SRQ accounting correct.

Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
---
 drivers/infiniband/hw/irdma/uk.c | 33 +++++++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c
index 05f512b01525..afd1f5ba0c28 100644
--- a/drivers/infiniband/hw/irdma/uk.c
+++ b/drivers/infiniband/hw/irdma/uk.c
@@ -1130,6 +1130,19 @@ bool irdma_uk_cq_empty(struct irdma_cq_uk *cq)
 	return polarity != cq->polarity;
 }
 
+/**
+ * irdma_srq_release_wqe() - Release an SRQ WQE.
+ * @srq: SRQ
+ */
+static void irdma_srq_release_wqe(struct irdma_srq_uk *srq)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(srq->lock, flags);
+	IRDMA_RING_MOVE_TAIL(srq->srq_ring);
+	spin_unlock_irqrestore(srq->lock, flags);
+}
+
 /**
  * irdma_uk_cq_poll_cmpl - get cq completion info
  * @cq: hw cq
@@ -1226,6 +1239,12 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq,
 		get_64bit_val(cqe, 8, &comp_ctx);
 	qp = (struct irdma_qp_uk *)(unsigned long)comp_ctx;
 	if (!qp || qp->destroy_pending) {
+		/* destroy_pending is set prior to locking and scrubbing the CQ
+		 * so this can potentially be reached.
+		 */
+		if (qp && is_srq && info->q_type == IRDMA_CQE_QTYPE_RQ &&
+		    qp->srq_uk)
+			irdma_srq_release_wqe(qp->srq_uk);
 		ret_code = -EFAULT;
 		goto exit;
 	}
@@ -1278,8 +1297,6 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq,
 	info->op_type = (u8)FIELD_GET(IRDMACQ_OP, qword3);
 
 	if (info->q_type == IRDMA_CQE_QTYPE_RQ && is_srq) {
-		unsigned long flags;
-
 		srq = qp->srq_uk;
 
 		get_64bit_val(cqe, 8, &info->wr_id);
@@ -1292,11 +1309,9 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq,
 		} else {
 			info->stag_invalid_set = false;
 		}
-		spin_lock_irqsave(srq->lock, flags);
-		IRDMA_RING_MOVE_TAIL(srq->srq_ring);
-		spin_unlock_irqrestore(srq->lock, flags);
-		pring = &srq->srq_ring;
 
+		irdma_srq_release_wqe(srq);
+		pring = &srq->srq_ring;
 	} else if (info->q_type == IRDMA_CQE_QTYPE_RQ && !is_srq) {
 		u32 array_idx;
 
@@ -1792,8 +1807,12 @@ void irdma_uk_clean_cq(struct irdma_qp_uk *qp, struct irdma_cq_uk *cq)
 
 		if (cq->avoid_mem_cflct && FIELD_GET(IRDMA_CQ_SRQ, qword3)) {
 			get_64bit_val(cqe, 40, &comp_ctx);
-			if ((struct irdma_qp_uk *)(unsigned long)comp_ctx == qp)
+			if ((struct irdma_qp_uk *)(unsigned long)comp_ctx == qp) {
+				if (qp->srq_uk &&
+				    FIELD_GET(IRDMA_CQ_SQ, qword3) == IRDMA_CQE_QTYPE_RQ)
+					irdma_srq_release_wqe(qp->srq_uk);
 				set_64bit_val(cqe, 40, 0);
+			}
 		} else {
 			get_64bit_val(cqe, 8, &comp_ctx);
 			if ((struct irdma_qp_uk *)(unsigned long)comp_ctx == qp)
-- 
2.56.0.455.g6c5a503b38-goog