• Mike Marciniszyn's avatar
    IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE · 54a485e9
    Mike Marciniszyn authored
    The lookaside count is improperly initialized to the size of the
    Receive Queue with the additional +1.  In the traces below, the
    RQ size is 384, so the count was set to 385.
    
    The lookaside count is then rarely refreshed.  Note the high and
    incorrect count in the trace below:
    
    rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
    	qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
    rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
    
    The head,tail indicate there is only one RWQE posted although the count
    says 385 and we correctly return the element 0.
    
    The next call to rvt_get_rwqe with the decremented count:
    
    rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
    	qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
    rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
    
    Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
    which is not valid because of the bogus high count.
    
    Best case, the RWQE has never been posted and the rc logic sees an RWQE
    that is too small (all zeros) and puts the QP into an error state.
    
    In the worst case, a server slow at posting receive buffers might fool
    rvt_get_rwqe() into fetching an old RWQE and corrupt memory.
    
    Fix by deleting the faulty initialization code and creating an
    inline to fetch the posted count and convert all callers to use
    new inline.
    
    Fixes: f592ae3c ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
    Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.comReported-by: default avatarZhaojuan Guo <zguo@redhat.com>
    Cc: <stable@vger.kernel.org> # 5.4.x
    Reviewed-by: default avatarKaike Wan <kaike.wan@intel.com>
    Signed-off-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
    Tested-by: default avatarHonggang Li <honli@redhat.com>
    Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
    54a485e9
rdmavt_qp.h 30.1 KB