forked from Minki/linux
f591822c3c
Once implicit MR is being called to be released by
ib_umem_notifier_release() its leaves were marked as "dying".
However, when dereg_mr()->mlx5_ib_free_implicit_mr()->mr_leaf_free() is
called, it skips running the mr_leaf_free_action (i.e. umem_odp->work)
when those leaves were marked as "dying".
As such ib_umem_release() for the leaves won't be called and their MRs
will be leaked as well.
When an application exits/killed without calling dereg_mr we might hit the
above flow.
This fatal scenario is reported by WARN_ON() upon
mlx5_ib_dealloc_ucontext() as ibcontext->per_mm_list is not empty, the
call trace can be seen below.
Originally the "dying" mark as part of ib_umem_notifier_release() was
introduced to prevent pagefault_mr() from returning a success response
once this happened. However, we already have today the completion
mechanism so no need for that in those flows any more. Even in case a
success response will be returned the firmware will not find the pages and
an error will be returned in the following call as a released mm will
cause ib_umem_odp_map_dma_pages() to permanently fail mmget_not_zero().
Fix the above issue by dropping the "dying" from the above flows. The
other flows that are using "dying" are still needed it for their
synchronization purposes.
WARNING: CPU: 1 PID: 7218 at
drivers/infiniband/hw/mlx5/main.c:2004
mlx5_ib_dealloc_ucontext+0x84/0x90 [mlx5_ib]
CPU: 1 PID: 7218 Comm: ibv_rc_pingpong Tainted: G E
5.2.0-rc6+ #13
Call Trace:
uverbs_destroy_ufile_hw+0xb5/0x120 [ib_uverbs]
ib_uverbs_close+0x1f/0x80 [ib_uverbs]
__fput+0xbe/0x250
task_work_run+0x88/0xa0
do_exit+0x2cb/0xc30
? __fput+0x14b/0x250
do_group_exit+0x39/0xb0
get_signal+0x191/0x920
? _raw_spin_unlock_bh+0xa/0x20
? inet_csk_accept+0x229/0x2f0
do_signal+0x36/0x5e0
? put_unused_fd+0x5b/0x70
? __sys_accept4+0x1a6/0x1e0
? inet_hash+0x35/0x40
? release_sock+0x43/0x90
? _raw_spin_unlock_bh+0xa/0x20
? inet_listen+0x9f/0x120
exit_to_usermode_loop+0x5c/0xc6
do_syscall_64+0x182/0x1b0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes:
|
||
---|---|---|
.. | ||
addr.c | ||
agent.c | ||
agent.h | ||
cache.c | ||
cgroup.c | ||
cm_msgs.h | ||
cm.c | ||
cma_configfs.c | ||
cma_priv.h | ||
cma.c | ||
core_priv.h | ||
counters.c | ||
cq.c | ||
device.c | ||
fmr_pool.c | ||
iwcm.c | ||
iwcm.h | ||
iwpm_msg.c | ||
iwpm_util.c | ||
iwpm_util.h | ||
mad_priv.h | ||
mad_rmpp.c | ||
mad_rmpp.h | ||
mad.c | ||
Makefile | ||
mr_pool.c | ||
multicast.c | ||
netlink.c | ||
nldev.c | ||
opa_smi.h | ||
packer.c | ||
rdma_core.c | ||
rdma_core.h | ||
restrack.c | ||
restrack.h | ||
roce_gid_mgmt.c | ||
rw.c | ||
sa_query.c | ||
sa.h | ||
security.c | ||
smi.c | ||
smi.h | ||
sysfs.c | ||
ucma.c | ||
ud_header.c | ||
umem_odp.c | ||
umem.c | ||
user_mad.c | ||
uverbs_cmd.c | ||
uverbs_ioctl.c | ||
uverbs_main.c | ||
uverbs_marshall.c | ||
uverbs_std_types_counters.c | ||
uverbs_std_types_cq.c | ||
uverbs_std_types_device.c | ||
uverbs_std_types_dm.c | ||
uverbs_std_types_flow_action.c | ||
uverbs_std_types_mr.c | ||
uverbs_std_types.c | ||
uverbs_uapi.c | ||
uverbs.h | ||
verbs.c |