linux-kernel - Re: [PATCH] rdma_rxe: call comp_handler without holding cq->cq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <885bb38c-4108-4fa2-a6d2-1e60d5e84af9@linux.dev>
Date: Wed, 13 Aug 2025 22:33:18 -0700
From: Zhu Yanjun <yanjun.zhu@...ux.dev>
To: Daisuke Matsuda <dskmtsd@...il.com>,
 Philipp Reisner <philipp.reisner@...bit.com>
Cc: Zhu Yanjun <zyjzyj2000@...il.com>, Jason Gunthorpe <jgg@...pe.ca>,
 Leon Romanovsky <leon@...nel.org>, linux-rdma@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] rdma_rxe: call comp_handler without holding cq->cq_lock

在 2025/8/12 8:54, Daisuke Matsuda 写道:
> On 2025/08/11 22:48, Zhu Yanjun wrote:
>> 在 2025/8/10 22:26, Philipp Reisner 写道:
>>> On Thu, Aug 7, 2025 at 3:09 AM Zhu Yanjun <yanjun.zhu@...ux.dev> wrote:
>>>>
>>>> 在 2025/8/6 5:39, Philipp Reisner 写道:
>>>>> Allow the comp_handler callback implementation to call ib_poll_cq().
>>>>> A call to ib_poll_cq() calls rxe_poll_cq() with the rdma_rxe driver.
>>>>> And rxe_poll_cq() locks cq->cq_lock. That leads to a spinlock 
>>>>> deadlock.
>>>>>
>>>>> The Mellanox and Intel drivers allow a comp_handler callback
>>>>> implementation to call ib_poll_cq().
>>>>>
>>>>> Avoid the deadlock by calling the comp_handler callback without
>>>>> holding cq->cw_lock.
>>>>>
>>>>> Signed-off-by: Philipp Reisner <philipp.reisner@...bit.com>
>>>>
>>>> ERROR: test_resize_cq (tests.test_cq.CQTest.test_resize_cq)
>>>> Test resize CQ, start with specific value and then increase and 
>>>> decrease
>>>> ----------------------------------------------------------------------
>>>> Traceback (most recent call last):
>>>>     File "/root/deb/rdma-core/tests/test_cq.py", line 135, in 
>>>> test_resize_cq
>>>>       u.poll_cq(self.client.cq)
>>>>     File "/root/deb/rdma-core/tests/utils.py", line 687, in poll_cq
>>>>       wcs = _poll_cq(cq, count, data)
>>>>             ^^^^^^^^^^^^^^^^^^^^^^^^^
>>>>     File "/root/deb/rdma-core/tests/utils.py", line 669, in _poll_cq
>>>>       raise PyverbsError(f'Got timeout on polling ({count} CQEs 
>>>> remaining)')
>>>> pyverbs.pyverbs_error.PyverbsError: Got timeout on polling (1 CQEs
>>>> remaining)
>>>>
>>>> After I applied your patch in kervel v6.16, I got the above errors.
>>>>
>>>> Zhu Yanjun
>>>>
>>>
>>> Hello Zhu,
>>>
>>> When I run the test_resize_cq test in a loop (100 runs each) on the
>>> original code and with my patch, I get about the same failure rate.
>>
>> Add Daisuke Matsuda
>>
>> If I remember it correctly, when Daisuke and I discussed ODP patches, 
>> we both made tests with rxe, from our tests results, it seems that 
>> this test_resize_cq error does not occur.
> 
> Hi Zhu and Philipp,
> 
> As far as I know, this error has been present for some time.
> It might be possible to investigate further by capturing a memory dump 
> while the polling is stuck, but I have not had time to do that yet.
> At least, I can confirm that this is not a regression caused by 
> Philipp's patch.

Hi, Daisuke

Thanks a lot. I’m now able to consistently reproduce this problem. I 
have created a commit here: 
https://github.com/zhuyj/linux/commit/8db3abc00bf49cac6ea1d5718d28c6516c94fb4e.

After applying this commit, I ran test_resize_cq 10,000 times, and the 
problem did not occur.

I’m not sure if there’s a better way to fix this issue. If anyone has a 
better solution, please share it.

Thanks a lot.
Zhu Yanjun

> 
> Thanks,
> Daisuke
>