From nobody Wed Dec 10 17:38:59 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dRNHl6KDPz6Ktmd for ; Wed, 10 Dec 2025 17:38:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dRNHl3kyKz3l3V for ; Wed, 10 Dec 2025 17:38:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765388339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZI9b4bfZiV4lG1zq8B6WZK1iHI1Mqlpv9tweZPlrMUM=; b=Vzcq79uYPBaTeopWFwxDsaJjywKH+pCN8Xd4lARHYfAaExYHZbHQv25+h0bWyN7rieJwvx csZ1ywvuPk0sr6jagbdx/M/e2Wtj49KlSlhjXWicYrYlYl6yCFbVVzAz6w9ia4WGYZLDAV iViZc0xL12uY2+Z+RSHYYzIOuRCQDTQs0TgxYl2A64bu7hQkI6auLGDGiz22e/yRWMQUGg g70bawUaHBIyTs0fFelsSkyPKm2vk0MUHA1n1Lmp52jI7Me/WqsacqTTTKfx6pU6UL4BDN aJRt7/lSzdmtA/AmGOhxw2jd7ff2RCanwKOBMjEOmlG7QCKN5M+Vc1A2od2/lA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765388339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZI9b4bfZiV4lG1zq8B6WZK1iHI1Mqlpv9tweZPlrMUM=; b=smwk56m64O0/NeZsWNeZu0KI7IrjrC5UzLknbyUVqayhFVs00HeUsEqfXwb22oPGmfVV8g t/mLMhTnIbnfsuIdGhbLnYcVTwn6WGRrRv3h2K1lPeRDBHz/4QnTKieniAWjWKDQDTIXnx rYqKlycAWqzrpR28DD2k7lyy9dMYh2lgYW05v6A2BLukbOCAjIr8aNd57hmntOGr2ISSFg JnqstRUEATIFt2oCsqRB9Hsj6LvKPoIZZ4IZpV21OqZgJt/JPxMj1yHNxkb0tbTvU9QXCy aldQnW0s/lGK1KKfTpyc/tI/rB0eys6NVRDNBI026y3Wmq9s8FD4VyTNy0axlg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765388339; a=rsa-sha256; cv=none; b=IrqxXmtIWImuQP72miimiVUdFZqyJhQg98khwFng48toR41PQXmc6kG1Have0AqBzJAdyE lOL5e6v4Y/8FSm0XPaTzN6e75qr1AKLzgYG7W8B1mtg3eRTUDOTHsWd2PkkeYggZQQcPyz 9fBzCRAfRk75K4O7EL89NleI/EVW1e10JbHfmHcNgt0XxPdRx0rHyiwYfPG83rbA05gChc 81NTo+g2RTogy2mMPWgXMOnWrrJDqLwyELPpvMTqva8BMcbA6Z3805fP5TJTcB9wL/bYDr J1arXVAN66Y0YMymSukxpnC6C54p2IiRxjrqyj7UVzHnynduxOQPXOJ9rYvhKg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dRNHl2p7Gzv3h for ; Wed, 10 Dec 2025 17:38:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id a199 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 10 Dec 2025 17:38:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Bartosz Sobczak From: Krzysztof Galazka Subject: git: bb69c090b5b2 - stable/15 - irdma(4): fix potential memory leak on qhash cqp operation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kgalazka X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: bb69c090b5b21ac243c5be2c5679114473c73b12 Auto-Submitted: auto-generated Date: Wed, 10 Dec 2025 17:38:59 +0000 Message-Id: <6939b033.a199.33fb60e6@gitrepo.freebsd.org> The branch stable/15 has been updated by kgalazka: URL: https://cgit.FreeBSD.org/src/commit/?id=bb69c090b5b21ac243c5be2c5679114473c73b12 commit bb69c090b5b21ac243c5be2c5679114473c73b12 Author: Bartosz Sobczak AuthorDate: 2025-11-24 18:41:41 +0000 Commit: Krzysztof Galazka CommitDate: 2025-12-10 17:20:56 +0000 irdma(4): fix potential memory leak on qhash cqp operation It was found that in some circumstances when launching non-waiting create qhash cqp operation the refcount on the cqp_request may be not properly decremented leading to a memory leak. Signed-off-by: Bartosz Sobczak Reviewed by: anzhu_netapp.com Tested by: mateusz.moga_intel.com Approved by: kbowling (mentor) Sponsored by: Intel Corporation Differential Revision: https://reviews.freebsd.org/D53732 (cherry picked from commit 7b6644e160ed63b633e7c68a3cacf2c71d216cd5) --- sys/dev/irdma/icrdma.c | 4 +- sys/dev/irdma/irdma_cm.c | 38 +------------ sys/dev/irdma/irdma_hw.c | 132 ++++++++++++++++++++++++++++++++++++--------- sys/dev/irdma/irdma_main.h | 3 +- 4 files changed, 114 insertions(+), 63 deletions(-) diff --git a/sys/dev/irdma/icrdma.c b/sys/dev/irdma/icrdma.c index 576a185b013f..a4f3904a820c 100644 --- a/sys/dev/irdma/icrdma.c +++ b/sys/dev/irdma/icrdma.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2021 - 2023 Intel Corporation + * Copyright (c) 2021 - 2025 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -52,7 +52,7 @@ /** * Driver version */ -char irdma_driver_version[] = "1.2.36-k"; +char irdma_driver_version[] = "1.2.37-k"; /** * irdma_init_tunable - prepare tunables diff --git a/sys/dev/irdma/irdma_cm.c b/sys/dev/irdma/irdma_cm.c index d4d4f328fb43..f3ca761b32f6 100644 --- a/sys/dev/irdma/irdma_cm.c +++ b/sys/dev/irdma/irdma_cm.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2025 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -1683,31 +1683,6 @@ irdma_get_vlan_ipv4(struct iw_cm_id *cm_id, u32 *addr) return vlan_id; } -static int -irdma_manage_qhash_wait(struct irdma_pci_f *rf, struct irdma_cm_info *cm_info) -{ - struct irdma_cqp_request *cqp_request = cm_info->cqp_request; - int cnt = rf->sc_dev.hw_attrs.max_cqp_compl_wait_time_ms * CQP_TIMEOUT_THRESHOLD; - u32 ret_val; - - if (!cqp_request) - return -ENOMEM; - do { - irdma_cqp_ce_handler(rf, &rf->ccq.sc_cq); - mdelay(1); - } while (!READ_ONCE(cqp_request->request_done) && --cnt); - - ret_val = cqp_request->compl_info.op_ret_val; - irdma_put_cqp_request(&rf->cqp, cqp_request); - if (cnt) { - if (!ret_val) - return 0; - return -EINVAL; - } - - return -ETIMEDOUT; -} - /** * irdma_add_mqh_ifa_cb - Adds multiple qhashes for IPv4/IPv6 * @arg: Calback argument structure from irdma_add_mqh @@ -1771,16 +1746,7 @@ irdma_add_mqh_ifa_cb(void *arg, struct ifaddr *ifa, u_int count) irdma_iw_get_vlan_prio(child_listen_node->loc_addr, cm_info->user_pri, cm_info->ipv4); - ret = irdma_manage_qhash(iwdev, cm_info, - IRDMA_QHASH_TYPE_TCP_SYN, - IRDMA_QHASH_MANAGE_TYPE_ADD, - NULL, false); - if (ret) { - kfree(child_listen_node); - return ret; - } - /* wait for qhash finish */ - ret = irdma_manage_qhash_wait(iwdev->rf, cm_info); + ret = irdma_add_qhash_wait_no_lock(iwdev, cm_info); if (ret) { kfree(child_listen_node); return ret; diff --git a/sys/dev/irdma/irdma_hw.c b/sys/dev/irdma/irdma_hw.c index 05004b1ccc83..64c05b8663e0 100644 --- a/sys/dev/irdma/irdma_hw.c +++ b/sys/dev/irdma/irdma_hw.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2025 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -2581,35 +2581,22 @@ irdma_send_syn_cqp_callback(struct irdma_cqp_request *cqp_request) } /** - * irdma_manage_qhash - add or modify qhash + * irdma_qhash_info_prepare - fill info for qhash op * @iwdev: irdma device + * @cqp_info: cqp info * @cminfo: cm info for qhash * @etype: type (syn or quad) * @mtype: type of qhash - * @cmnode: cmnode associated with connection - * @wait: wait for completion */ -int -irdma_manage_qhash(struct irdma_device *iwdev, struct irdma_cm_info *cminfo, - enum irdma_quad_entry_type etype, - enum irdma_quad_hash_manage_type mtype, void *cmnode, - bool wait) +static void +irdma_qhash_info_prepare(struct irdma_device *iwdev, + struct cqp_cmds_info *cqp_info, + struct irdma_cm_info *cminfo, + enum irdma_quad_entry_type etype, + enum irdma_quad_hash_manage_type mtype) { struct irdma_qhash_table_info *info; - struct irdma_cqp *iwcqp = &iwdev->rf->cqp; - struct irdma_cqp_request *cqp_request; - struct cqp_cmds_info *cqp_info; - struct irdma_cm_node *cm_node = cmnode; - int status; - - cqp_request = irdma_alloc_and_get_cqp_request(iwcqp, wait); - if (!cqp_request) - return -ENOMEM; - cminfo->cqp_request = cqp_request; - if (!wait) - atomic_inc(&cqp_request->refcnt); - cqp_info = &cqp_request->info; info = &cqp_info->in.u.manage_qhash_table_entry.info; memset(info, 0, sizeof(*info)); info->vsi = &iwdev->vsi; @@ -2641,6 +2628,105 @@ irdma_manage_qhash(struct irdma_device *iwdev, struct irdma_cm_info *cminfo, info->src_ip[2] = cminfo->rem_addr[2]; info->src_ip[3] = cminfo->rem_addr[3]; } + cqp_info->cqp_cmd = IRDMA_OP_MANAGE_QHASH_TABLE_ENTRY; + cqp_info->post_sq = 1; +} + +/** + * irdma_add_qhash_wait_no_lock - add qhash, blocking w/o lock + * @iwdev: irdma device + * @cminfo: cm info for qhash + */ +int +irdma_add_qhash_wait_no_lock(struct irdma_device *iwdev, + struct irdma_cm_info *cminfo) +{ + struct irdma_qhash_table_info *info; + struct irdma_cqp *iwcqp = &iwdev->rf->cqp; + struct irdma_cqp_request *cqp_request; + struct cqp_cmds_info *cqp_info; + int cnt = iwdev->rf->sc_dev.hw_attrs.max_cqp_compl_wait_time_ms * CQP_TIMEOUT_THRESHOLD; + int status; + int ret_val; + + cqp_request = irdma_alloc_and_get_cqp_request(iwcqp, false); + if (!cqp_request) + return -ENOMEM; + + cqp_info = &cqp_request->info; + info = &cqp_info->in.u.manage_qhash_table_entry.info; + irdma_qhash_info_prepare(iwdev, cqp_info, cminfo, IRDMA_QHASH_TYPE_TCP_SYN, + IRDMA_QHASH_MANAGE_TYPE_ADD); + if (info->ipv4_valid) + irdma_debug(&iwdev->rf->sc_dev, IRDMA_DEBUG_CM, + "ADD caller: %pS loc_port=0x%04x rem_port=0x%04x loc_addr=%x rem_addr=%x mac=%x:%x:%x:%x:%x:%x, vlan_id=%d\n", + __builtin_return_address(0), info->src_port, + info->dest_port, info->src_ip[0], info->dest_ip[0], + info->mac_addr[0], info->mac_addr[1], + info->mac_addr[2], info->mac_addr[3], + info->mac_addr[4], info->mac_addr[5], + cminfo->vlan_id); + else + irdma_debug(&iwdev->rf->sc_dev, IRDMA_DEBUG_CM, + "ADD caller: %pS loc_port=0x%04x rem_port=0x%04x loc_addr=%x:%x:%x:%x rem_addr=%x:%x:%x:%x mac=%x:%x:%x:%x:%x:%x, vlan_id=%d\n", + __builtin_return_address(0), info->src_port, + info->dest_port, IRDMA_PRINT_IP6(info->src_ip), + IRDMA_PRINT_IP6(info->dest_ip), info->mac_addr[0], + info->mac_addr[1], info->mac_addr[2], + info->mac_addr[3], info->mac_addr[4], + info->mac_addr[5], cminfo->vlan_id); + + cqp_info->in.u.manage_qhash_table_entry.cqp = &iwdev->rf->cqp.sc_cqp; + cqp_info->in.u.manage_qhash_table_entry.scratch = (uintptr_t)cqp_request; + status = irdma_handle_cqp_op(iwdev->rf, cqp_request); + if (status) { + irdma_put_cqp_request(iwcqp, cqp_request); + irdma_dev_warn(&iwdev->ibdev, "manage_qhash cqp op failure %d\n", status); + return status; + } + + do { + irdma_cqp_ce_handler(iwdev->rf, &iwdev->rf->ccq.sc_cq); + mdelay(1); + } while (!READ_ONCE(cqp_request->request_done) && --cnt); + + ret_val = cqp_request->compl_info.op_ret_val; + status = (cnt) ? ret_val : -ETIMEDOUT; + + irdma_put_cqp_request(iwcqp, cqp_request); + + return status; +} + +/** + * irdma_manage_qhash - add or modify qhash + * @iwdev: irdma device + * @cminfo: cm info for qhash + * @etype: type (syn or quad) + * @mtype: type of qhash + * @cmnode: cmnode associated with connection + * @wait: wait for completion + */ +int +irdma_manage_qhash(struct irdma_device *iwdev, struct irdma_cm_info *cminfo, + enum irdma_quad_entry_type etype, + enum irdma_quad_hash_manage_type mtype, void *cmnode, + bool wait) +{ + struct irdma_qhash_table_info *info; + struct irdma_cqp *iwcqp = &iwdev->rf->cqp; + struct irdma_cqp_request *cqp_request; + struct cqp_cmds_info *cqp_info; + struct irdma_cm_node *cm_node = cmnode; + int status; + + cqp_request = irdma_alloc_and_get_cqp_request(iwcqp, wait); + if (!cqp_request) + return -ENOMEM; + + cqp_info = &cqp_request->info; + info = &cqp_info->in.u.manage_qhash_table_entry.info; + irdma_qhash_info_prepare(iwdev, cqp_info, cminfo, etype, mtype); if (cmnode) { cqp_request->callback_fcn = irdma_send_syn_cqp_callback; cqp_request->param = cmnode; @@ -2671,8 +2757,6 @@ irdma_manage_qhash(struct irdma_device *iwdev, struct irdma_cm_info *cminfo, cqp_info->in.u.manage_qhash_table_entry.cqp = &iwdev->rf->cqp.sc_cqp; cqp_info->in.u.manage_qhash_table_entry.scratch = (uintptr_t)cqp_request; - cqp_info->cqp_cmd = IRDMA_OP_MANAGE_QHASH_TABLE_ENTRY; - cqp_info->post_sq = 1; status = irdma_handle_cqp_op(iwdev->rf, cqp_request); if (status && cm_node && !wait) irdma_rem_ref_cm_node(cm_node); diff --git a/sys/dev/irdma/irdma_main.h b/sys/dev/irdma/irdma_main.h index 5b292ceafea8..9181f3b70463 100644 --- a/sys/dev/irdma/irdma_main.h +++ b/sys/dev/irdma/irdma_main.h @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2025 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -563,6 +563,7 @@ int irdma_manage_qhash(struct irdma_device *iwdev, struct irdma_cm_info *cminfo, enum irdma_quad_entry_type etype, enum irdma_quad_hash_manage_type mtype, void *cmnode, bool wait); +int irdma_add_qhash_wait_no_lock(struct irdma_device *iwdev, struct irdma_cm_info *cminfo); void irdma_receive_ilq(struct irdma_sc_vsi *vsi, struct irdma_puda_buf *rbuf); void irdma_free_sqbuf(struct irdma_sc_vsi *vsi, void *bufp); void irdma_free_qp_rsrc(struct irdma_qp *iwqp);