IB/mad: Check available slots before posting receive WRs

The ib_post_receive_mads() function handles posting receive work
requests (WRs) to MAD QPs and is called in two cases:
1) When a MAD port is opened.
2) When a receive WQE is consumed upon receiving a new MAD.

Whereas, if MADs arrive during the port open phase, a race condition
might cause an extra WR to be posted, exceeding the QP’s capacity.
This leads to failures such as:
infiniband mlx5_0: ib_post_recv failed: -12
infiniband mlx5_0: Couldn't post receive WRs
infiniband mlx5_0: Couldn't start port
infiniband mlx5_0: Couldn't open port 1

Fix this by checking the current receive count before posting a new WR.
If the QP’s receive queue is full, do not post additional WRs.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Link: https://patch.msgid.link/c4984ba3c3a98a5711a558bccefcad789587ecf1.1741875592.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 1fd54d5c4dd8b713c1c1854d0658fdebfd309f67..73f3a0b9a54b5fc058209d46abe71e18aa476130 100644 (file)
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                                    struct ib_mad_private *mad)
 {
        unsigned long flags;
-       int post, ret;
        struct ib_mad_private *mad_priv;
        struct ib_sge sg_list;
        struct ib_recv_wr recv_wr;
        struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
+       int ret = 0;
 
        /* Initialize common scatter list fields */
        sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
        recv_wr.sg_list = &sg_list;
        recv_wr.num_sge = 1;
 
-       do {
+       while (true) {
                /* Allocate and map receive buffer */
                if (mad) {
                        mad_priv = mad;
@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                } else {
                        mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),
                                                     GFP_ATOMIC);
-                       if (!mad_priv) {
-                               ret = -ENOMEM;
-                               break;
-                       }
+                       if (!mad_priv)
+                               return -ENOMEM;
                }
                sg_list.length = mad_priv_dma_size(mad_priv);
                sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                                                 DMA_FROM_DEVICE);
                if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
                                                  sg_list.addr))) {
-                       kfree(mad_priv);
                        ret = -ENOMEM;
-                       break;
+                       goto free_mad_priv;
                }
                mad_priv->header.mapping = sg_list.addr;
                mad_priv->header.mad_list.mad_queue = recv_queue;
                mad_priv->header.mad_list.cqe.done = ib_mad_recv_done;
                recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe;
-
-               /* Post receive WR */
                spin_lock_irqsave(&recv_queue->lock, flags);
-               post = (++recv_queue->count < recv_queue->max_active);
-               list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
+               if (recv_queue->count >= recv_queue->max_active) {
+                       /* Fully populated the receive queue */
+                       spin_unlock_irqrestore(&recv_queue->lock, flags);
+                       break;
+               }
+               recv_queue->count++;
+               list_add_tail(&mad_priv->header.mad_list.list,
+                             &recv_queue->list);
                spin_unlock_irqrestore(&recv_queue->lock, flags);
+
                ret = ib_post_recv(qp_info->qp, &recv_wr, NULL);
                if (ret) {
                        spin_lock_irqsave(&recv_queue->lock, flags);
                        list_del(&mad_priv->header.mad_list.list);
                        recv_queue->count--;
                        spin_unlock_irqrestore(&recv_queue->lock, flags);
-                       ib_dma_unmap_single(qp_info->port_priv->device,
-                                           mad_priv->header.mapping,
-                                           mad_priv_dma_size(mad_priv),
-                                           DMA_FROM_DEVICE);
-                       kfree(mad_priv);
                        dev_err(&qp_info->port_priv->device->dev,
                                "ib_post_recv failed: %d\n", ret);
                        break;
                }
-       } while (post);
+       }
 
+       ib_dma_unmap_single(qp_info->port_priv->device,
+                           mad_priv->header.mapping,
+                           mad_priv_dma_size(mad_priv), DMA_FROM_DEVICE);
+free_mad_priv:
+       kfree(mad_priv);
        return ret;
 }