lkml.org 
[lkml]   [2019]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 155/162] IB/hfi1: Drop stale TID RDMA packets
    Date
    From: Kaike Wan <kaike.wan@intel.com>

    commit d58c1834bf0d218a0bc00f8fb44874551b21da84 upstream.

    In a congested fabric with adaptive routing enabled, traces show that
    the sender could receive stale TID RDMA NAK packets that contain newer
    KDETH PSNs and older Verbs PSNs. If not dropped, these packets could
    cause the incorrect rewinding of the software flows and the incorrect
    completion of TID RDMA WRITE requests, and eventually leading to memory
    corruption and kernel crash.

    The current code drops stale TID RDMA ACK/NAK packets solely based
    on KDETH PSNs, which may lead to erroneous processing. This patch
    fixes the issue by also checking the Verbs PSN. Addition checks are
    added before rewinding the TID RDMA WRITE DATA packets.

    Fixes: 9e93e967f7b4 ("IB/hfi1: Add a function to receive TID RDMA ACK packet")
    Cc: <stable@vger.kernel.org>
    Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Kaike Wan <kaike.wan@intel.com>
    Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Link: https://lore.kernel.org/r/20190815192033.105923.44192.stgit@awfm-01.aw.intel.com
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/infiniband/hw/hfi1/tid_rdma.c | 14 +++++++++++---
    1 file changed, 11 insertions(+), 3 deletions(-)

    --- a/drivers/infiniband/hw/hfi1/tid_rdma.c
    +++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
    @@ -4480,7 +4480,7 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi
    struct rvt_swqe *wqe;
    struct tid_rdma_request *req;
    struct tid_rdma_flow *flow;
    - u32 aeth, psn, req_psn, ack_psn, fspsn, resync_psn, ack_kpsn;
    + u32 aeth, psn, req_psn, ack_psn, flpsn, resync_psn, ack_kpsn;
    unsigned long flags;
    u16 fidx;

    @@ -4509,6 +4509,9 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi
    ack_kpsn--;
    }

    + if (unlikely(qp->s_acked == qp->s_tail))
    + goto ack_op_err;
    +
    wqe = rvt_get_swqe_ptr(qp, qp->s_acked);

    if (wqe->wr.opcode != IB_WR_TID_RDMA_WRITE)
    @@ -4521,7 +4524,8 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi
    trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail, flow);

    /* Drop stale ACK/NAK */
    - if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0)
    + if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0 ||
    + cmp_psn(req_psn, flow->flow_state.resp_ib_psn) < 0)
    goto ack_op_err;

    while (cmp_psn(ack_kpsn,
    @@ -4683,8 +4687,12 @@ done:
    switch ((aeth >> IB_AETH_CREDIT_SHIFT) &
    IB_AETH_CREDIT_MASK) {
    case 0: /* PSN sequence error */
    + if (!req->flows)
    + break;
    flow = &req->flows[req->acked_tail];
    - fspsn = full_flow_psn(flow, flow->flow_state.spsn);
    + flpsn = full_flow_psn(flow, flow->flow_state.lpsn);
    + if (cmp_psn(psn, flpsn) > 0)
    + break;
    trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail,
    flow);
    req->r_ack_psn = mask_psn(be32_to_cpu(ohdr->bth[2]));

    \
     
     \ /
      Last update: 2019-08-27 10:08    [W:4.114 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site