[PATCH for-next] RDMA/ionic: Fix GSI QP ID release

[PATCH for-next] RDMA/ionic: Fix GSI QP ID release

[Håkon Bugge]

QPID allocation differs between ordinary QPs and GSI QPs. If GSI QP
creation fails after allocating its QPID, or is destroyed, we see in
the log (trimmed for brevity):

kernel: ida_free called for id=32 which is not allocated.
kernel: WARNING: CPU: 47 PID: 6673 at lib/idr.c:527 ida_free+0xde/0x140
kernel: CPU: 47 UID: 0 PID: 6673 Comm: modprobe Not tainted 6.12.0+ #18
kernel: RIP: 0010:ida_free+0xde/0x140
kernel: Call Trace:
kernel: <TASK>
kernel: ionic_create_qp+0x4f5/0xbe0 [ionic_rdma]
kernel: create_qp+0x19a/0x290 [ib_core]
kernel: ib_create_qp_kernel+0x3a/0xe0 [ib_core]
kernel: create_mad_qp+0x8e/0xd6 [ib_core]
kernel: ib_mad_port_open+0x268/0x3f2 [ib_core]

GSI QPs reserve allocator ID IB_QPT_GSI directly, whereas ordinary QPs
encode the allocated ID in the QPID. Calling ionic_put_qpid() for a
GSI QP incorrectly applies the ordinary QPID conversion and releases
an unallocated ID.

Release IB_QPT_GSI directly in both the creation error path and the
destruction path.

Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path")
Cc: <stable@vger.kernel.org>
Reported-by: Keith Lucas <keith.lucas@oracle.com>
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Keith Lucas <keith.lucas@oracle.com>
---
 drivers/infiniband/hw/ionic/ionic_controlpath.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
index a70ef59a8064e..cd623f1de38a3 100644
--- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
+++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c
@@ -2450,7 +2450,11 @@ int ionic_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attr,
 err_ahid:
 	kfree(qp->hdr);
 err_ah_alloc:
-	ionic_put_qpid(dev, qp->qpid);
+	if (attr->qp_type == IB_QPT_GSI)
+		ionic_resid_put(&dev->inuse_qpid, IB_QPT_GSI);
+	else
+		ionic_put_qpid(dev, qp->qpid);
+
 	return rc;
 }
 
@@ -2762,7 +2766,10 @@ int ionic_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
 		ionic_put_ahid(dev, qp->ahid);
 		kfree(qp->hdr);
 	}
-	ionic_put_qpid(dev, qp->qpid);
+	if (qp->qpid == IB_QPT_GSI)
+		ionic_resid_put(&dev->inuse_qpid, IB_QPT_GSI);
+	else
+		ionic_put_qpid(dev, qp->qpid);
 
 	return 0;
 }
-- 
2.43.5

Re: [PATCH for-next] RDMA/ionic: Fix GSI QP ID release

[Abhijit Gangurde]

On 10/21/26 21:46, Håkon Bugge wrote:
> QPID allocation differs between ordinary QPs and GSI QPs. If GSI QP
> creation fails after allocating its QPID, or is destroyed, we see in
> the log (trimmed for brevity):
>
> kernel: ida_free called for id=32 which is not allocated.
> kernel: WARNING: CPU: 47 PID: 6673 at lib/idr.c:527 ida_free+0xde/0x140
> kernel: CPU: 47 UID: 0 PID: 6673 Comm: modprobe Not tainted 6.12.0+ #18
> kernel: RIP: 0010:ida_free+0xde/0x140
> kernel: Call Trace:
> kernel: <TASK>
> kernel: ionic_create_qp+0x4f5/0xbe0 [ionic_rdma]
> kernel: create_qp+0x19a/0x290 [ib_core]
> kernel: ib_create_qp_kernel+0x3a/0xe0 [ib_core]
> kernel: create_mad_qp+0x8e/0xd6 [ib_core]
> kernel: ib_mad_port_open+0x268/0x3f2 [ib_core]
>
> GSI QPs reserve allocator ID IB_QPT_GSI directly, whereas ordinary QPs
> encode the allocated ID in the QPID. Calling ionic_put_qpid() for a
> GSI QP incorrectly applies the ordinary QPID conversion and releases
> an unallocated ID.
>
> Release IB_QPT_GSI directly in both the creation error path and the
> destruction path.
>
> Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path")
> Cc: <stable@vger.kernel.org>
> Reported-by: Keith Lucas <keith.lucas@oracle.com>
> Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
> Tested-by: Keith Lucas <keith.lucas@oracle.com>
> ---
>   drivers/infiniband/hw/ionic/ionic_controlpath.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
> index a70ef59a8064e..cd623f1de38a3 100644
> --- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
> +++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c
> @@ -2450,7 +2450,11 @@ int ionic_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attr,
>   err_ahid:
>   	kfree(qp->hdr);
>   err_ah_alloc:
> -	ionic_put_qpid(dev, qp->qpid);
> +	if (attr->qp_type == IB_QPT_GSI)
> +		ionic_resid_put(&dev->inuse_qpid, IB_QPT_GSI);
> +	else
> +		ionic_put_qpid(dev, qp->qpid);
> +
>   	return rc;
>   }
>   
> @@ -2762,7 +2766,10 @@ int ionic_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
>   		ionic_put_ahid(dev, qp->ahid);
>   		kfree(qp->hdr);
>   	}
> -	ionic_put_qpid(dev, qp->qpid);
> +	if (qp->qpid == IB_QPT_GSI)
> +		ionic_resid_put(&dev->inuse_qpid, IB_QPT_GSI);
> +	else
> +		ionic_put_qpid(dev, qp->qpid);
>   
>   	return 0;
>   }


ionic_put_qpid(1) frees 32 because this firmware reports udma_shift 0. 
That is a recent firmware addition where the QID space is linear and QPs 
are no longer balanced across UDMAs.

Releasing IB_QPT_GSI directly avoids the warning, but it leaves that 
numbering in place. I will send a patch that supports this linear 
configuration. With udma_shift 0 the QID mapping is an identity and 
there is one UDMA, so ionic_put_qpid() frees the index  
ionic_get_gsi_qpid() reserved.

Thanks for the report.

Abhijit