Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH] RDMA/rxe: Use kzalloc() to alloc map_set
To:     "lizhijian@fujitsu.com" <lizhijian@fujitsu.com>,
        Haris Iqbal <haris.iqbal@ionos.com>
Cc:     Jason Gunthorpe <jgg@nvidia.com>,
        Bob Pearson <rpearsonhpe@gmail.com>,
        Zhu Yanjun <zyjzyj2000@gmail.com>,
        "linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Aleksei Marov <aleksei.marov@ionos.com>,
        Jinpu Wang <jinpu.wang@ionos.com>
References: <20220518043725.771549-1-lizhijian@fujitsu.com>
 <20220520144511.GA2302907@nvidia.com>
 <d956bac8-36a6-0148-6f9c-fa43c8c272a7@fujitsu.com>
 <3e3373f5-7b12-a8e8-2d73-c2976b272290@fujitsu.com>
 <CAJpMwyhhWSC_x4Fef32iW5Umzk5bLdJFweuZmN9LEJTQGyHfbQ@mail.gmail.com>
 <123f5c7e-c2eb-7703-ace9-bc5074a394dd@fujitsu.com>
From:   Guoqing Jiang <guoqing.jiang@linux.dev>
Message-ID: <94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev>
Date:   Wed, 25 May 2022 12:11:44 +0800
MIME-Version: 1.0
In-Reply-To: <123f5c7e-c2eb-7703-ace9-bc5074a394dd@fujitsu.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Precedence: bulk


On 5/25/22 9:31 AM, lizhijian@fujitsu.com wrote:
>
> On 24/05/2022 18:56, Haris Iqbal wrote:
>> On Tue, May 24, 2022 at 6:00 AM lizhijian@fujitsu.com
>> <lizhijian@fujitsu.com> wrote:
>>> Hi Jason & Bob
>>> CC Guoqing
>>>
>>> @Guoqing, It may correlate with your previous bug report: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/
>>>
>>>
>>> It's observed that a same MR in rnbd server will trigger below code
>>> path:
>>>     -> rxe_mr_init_fast()
>>>     |-> alloc map_set() # map_set is uninitialized
>>>     |...-> rxe_map_mr_sg() # build the map_set
>>>         |-> rxe_mr_set_page()
>>>     |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means
>>>                              # we can access host memory(such rxe_mr_copy)
>>>     |...-> rxe_invalidate_mr() # mr->state change to FREE from VALID
>>>     |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE,
>>>                              # but map_set was not built again
>>>     |...-> rxe_mr_copy() # kernel crash due to access wild addresses
>>>                          # that lookup from the map_set

Yes, it could be similar issue thought I didn't get kernel crash, but it 
was FMR relevant.

https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/#m5dc6898375cedf17fea13ccebf595aac0454c841

> Yes, this workaround should work but expensive.
> It seems Bob has started a new thread to discuss the FMRs in https://www.spinics.net/lists/linux-rdma/msg110836.html

Will give it a try, thanks for the link.

Thanks,
Guoqing