RE: [PATCH] core/verb.c: fix kernel panic: always initialize struct ib_qp *qp->usecnt

Hefty, Sean
2012-01-19T20:29:16Z

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 1804 bytes --]

> We have just been investigating kernel panics related to
> cq->ibcq.event_handler() completion calls.
>
> Reason is that ib_destroy_qp() fails with -EBUSY. Further investigation
> revealed qp->usecnt is not initialized. This counter was introduced
> in linux-3.2 by commit 0e0ec7e0638ef48e0c661873dfcc8caccab984c6
> and is only initialized for IB_QPT_XRC_TGT, but also checked in
> ib_destroy_qp()
> for any qp type.
>
> Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
> Signed-off-by: Sven Breuner <sven.breuner@itwm.fraunhofer.de>

Reviewed-by: Sean Hefty <sean.hefty@intel.com>

> ---

Good catch. I did all my testing with mlx4, which just happens to use kzalloc when allocating the QP.

> drivers/infiniband/core/verbs.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index 602b1bd..575b780 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
> qp->uobject = NULL;
> qp->qp_type = qp_init_attr->qp_type;
>
> + atomic_set(&qp->usecnt, 0);
> if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
> qp->event_handler = __ib_shared_qp_event_handler;
> qp->qp_context = qp;
> @@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
> qp->xrcd = qp_init_attr->xrcd;
> atomic_inc(&qp_init_attr->xrcd->usecnt);
> INIT_LIST_HEAD(&qp->open_list);
> - atomic_set(&qp->usecnt, 0);
>
> real_qp = qp;
> qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,

N‹§²æìr¸›yúèšØb²X¬¶Ç§vØ^–)Þº{.nÇ+‰·¥Š{±­ÙšŠ{ayº\x1dÊ‡Ú™ë,j\a­¢f£¢·hš‹»öì\x17/oSc¾™Ú³9˜uÀ¦æå‰È&jw¨®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿïêäz¹Þ–Šàþf£¢·hšˆ§~ˆmš