From nobody Sun Feb 8 20:34:21 2026 Received: from mail-ua1-f98.google.com (mail-ua1-f98.google.com [209.85.222.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C0FF48E8FB for ; Thu, 8 Jan 2026 10:26:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.98 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767868016; cv=none; b=IAEArDe697Iahi0NLRitDjbs1Q+d5N+7RsjCkE83UmnEJ8la5B5AEf1VJpH5dYw1VOayTytxVx6byX4/QsQB24MlduB/6hdmR9ufNLhqSvTEScWFdhEft91iwQWz5olBaqZ50MElg3NTZ9REKCy6jgJgRLF0XmICmLZwkn7sVzA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767868016; c=relaxed/simple; bh=zXlIp14bGuRNzKmm8Dku8f9Yb6RD5C9Q9gIjSx8ABmM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Ak+bWv07xux3hjQfKrzSmIf36nT02LJ/Vn5LyTWJ7uWBzDUVg8/ZzdWRKJYcwzYkOFEfbJQ2GURTi6b1fICyPvatGsxEwFNU/AKNll6wkPZGOr84zrPPR4g+Hu/9Fh2nDvplYz8GGoqk4lYhM0leNZmyNVSc434PBrs0rHuUHbU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=Sp0DxZ3M; arc=none smtp.client-ip=209.85.222.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="Sp0DxZ3M" Received: by mail-ua1-f98.google.com with SMTP id a1e0cc1a2514c-941275fece4so759895241.1 for ; Thu, 08 Jan 2026 02:26:50 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767868008; x=1768472808; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=tY2+t0l557GSsjMoRko+cZX+m7SpHKP0G/1LAwo4WgE=; b=vKmaJZraQkB3mb662Y/7LIhPuNBG7Xkr8P3ADJnLhb6mMBloFL2nvjRONhZf8vrgRu b5/eliUN3oXnOvV7qtJRKngRKES4IulQH25KJALLxHPfFy1s/YY+bAjsnnxi+TwNMYMw goV5LPp2xUGGgeVjoCp8WfN94TXUWOciNnUSYS1Vxsj+tR8En8OY5vtvbuyN5f/exKbA q6AwT2Ipk53r0SJanwSyixUIqYkf378zSmmlMPiOWG7gln2b4/UPo3SlMk8xPU7Me2q3 Vaw5yVS63NKw/Bj6k881Bp7wV4P9Cy87lGnsMzqp7RMq6/nm2Q1765NBUifbba8MSsep R+CQ== X-Forwarded-Encrypted: i=1; AJvYcCVkDDpKC8AJVp9SnfxfiAxvohx/vIgflXNiZSk1qgorU33tD0ucY7hy8x0hMpHGoSmhTq5tDKmrBENQ9iY=@vger.kernel.org X-Gm-Message-State: AOJu0YyBEUKxb7oJnxJ3kPeoHE8vr5WlYsS3ddYobOmQy600e9mN8NYf wn0JKCdOj+gQyx6bDtOaVPxwTeqpDuqablNM/yGd/9PSHxT0AvBYhWIBy4vM1TdqOuCpcaOZP6z YER9cCbgOWqSsB8c9Kwepn0M1w0TmEWAxeDRVs6rHLw4+BTP0AIv4vDW5i3L1/GjENkhNJv8Xzb +w4BUjuu4MXiuZOiSFY44h5W9Ij2iJq4unDGsTkscu7jxz33Zv+Pnph1uK97n2mTbxNXUbQzhgA yGWoPEc00sZmAge8k7qejkR0Q== X-Gm-Gg: AY/fxX4k2A6IVaB4mLVZZHYgflAqhpkLxh4nAs+TfUp4/CDJFpoPVwlkJJfQK9vTpbL HuIQX2ByH77N+OGoEZu7PbF2w0ppRzUqSqaoDQVGk0ORtIkAJdwNkwndE07xXWxPS8mGIM99KR8 leocsTwSDcoVxzZvjVP19M6P0THSyswpHiGlI6WGNrGisUNa9rZgQGP8eESyKOMeHBV8yxytFg+ yDax9/Q7495zfzH/GVcKupjWzmxKSp8CK7xM32bHnZUFuTrlR93VtMFrALiumWRbg9ETIu0EdEP skRZQXAiu0G2KzsCV4pMW71VXrZXENkuBx1wpEjamCB1x+rZa/37vFBrcrgz14TjVyhDfUQcMbB PSdVyofb5phaLI1x0OYfPIcFrKESHG2hk6xbGpVs45G448B41RZLiu51tuveieeOwaHAVIyHHyp uLUZXzJPWRpsaxPi+KmDe6/kQgZztoSgKDtgz14fWrRtBnEA== X-Google-Smtp-Source: AGHT+IH0IPXMRyIXQib/GMp7ywtvB1NiF98SOHREiRD0Zk3wiiKeDJWNWXH/gvOVR1bHuqzMl/5jhVH5sA9O X-Received: by 2002:a05:6102:4b02:b0:5d5:f6ae:38ca with SMTP id ada2fe7eead31-5ecb6935801mr1959211137.41.1767868007646; Thu, 08 Jan 2026 02:26:47 -0800 (PST) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-1.dlp.protect.broadcom.com. [144.49.247.1]) by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-5ec770042dasm1180107137.1.2026.01.08.02.26.46 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Jan 2026 02:26:47 -0800 (PST) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-4ffb40c0272so46997581cf.3 for ; Thu, 08 Jan 2026 02:26:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1767868006; x=1768472806; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tY2+t0l557GSsjMoRko+cZX+m7SpHKP0G/1LAwo4WgE=; b=Sp0DxZ3McFmgShx9No+V6z1tNltN4ThZO5AWF2jXJTL0jR+Ll1YjO63erxg6g83PcM NBDKvH4W0N7FNk8zho62rqD7VEuqQBx315unlwOIomOIaqoskYRloVAaLGIEynHDbPMq js7JMgGBQe3YJW0r4hLegzflSudBUougMq5Uo= X-Forwarded-Encrypted: i=1; AJvYcCWjmejfvM5vAMH09PMGL7LwGZoEU9oHfvt1aWtaI0LtwBvJ72Tlg0If4DTF4D+IDB88MrwOxRii/W184LY=@vger.kernel.org X-Received: by 2002:a05:622a:188d:b0:4ee:2721:9ec9 with SMTP id d75a77b69052e-4ffb4b201b8mr74017311cf.73.1767868005966; Thu, 08 Jan 2026 02:26:45 -0800 (PST) X-Received: by 2002:a05:622a:188d:b0:4ee:2721:9ec9 with SMTP id d75a77b69052e-4ffb4b201b8mr74016801cf.73.1767868005138; Thu, 08 Jan 2026 02:26:45 -0800 (PST) Received: from shivania.lvn.broadcom.net ([192.19.161.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-4ffa8e362fdsm45124721cf.21.2026.01.08.02.26.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Jan 2026 02:26:44 -0800 (PST) From: Shivani Agarwal To: stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: jgg@ziepe.ca, leon@kernel.org, zyjzyj2000@gmail.com, mbloch@nvidia.com, parav@nvidia.com, mrgolin@amazon.com, roman.gushchin@linux.dev, wangliang74@huawei.com, marco.crivellari@suse.com, zhao.xichao@vivo.com, haggaie@mellanox.com, monis@mellanox.com, dledford@redhat.com, amirv@mellanox.com, kamalh@mellanox.com, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, ajay.kaher@broadcom.com, alexey.makhalov@broadcom.com, vamsi-krishna.brahmajosyula@broadcom.com, yin.ding@broadcom.com, tapas.kundu@broadcom.com, Zhu Yanjun , syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com, Sasha Levin , Shivani Agarwal Subject: [PATCH 1/2 v6.6] RDMA/rxe: Remove the direct link to net_device Date: Thu, 8 Jan 2026 02:05:39 -0800 Message-Id: <20260108100540.672666-2-shivani.agarwal@broadcom.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260108100540.672666-1-shivani.agarwal@broadcom.com> References: <20260108100540.672666-1-shivani.agarwal@broadcom.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e Content-Type: text/plain; charset="utf-8" From: Zhu Yanjun [ Upstream commit 2ac5415022d16d63d912a39a06f32f1f51140261 ] The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following analyze this problem. In the following Call Traces: " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c= :8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ib_cache_event_task Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [inline] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 " 1). In the link [1], " infiniband syz2: set down " This means that on 839.350575, the event ib_cache_event_task was sent andi queued in ib_wq. 2). In the link [1], " team0 (unregistering): Port device team_slave_0 removed " It indicates that before 843.251853, the net device should be freed. 3). In the link [1], " BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 " This means that on 850.559070, this slab-use-after-free problem occurred. In all, on 839.350575, the event ib_cache_event_task was sent and queued in ib_wq, before 843.251853, the net device veth was freed. on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred. [1] https://syzkaller.appspot.com/x/log.txt?x=3D12e7025f980000 Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D4b87489410b4efd181bf Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin [Shivani: - exported ib_device_get_netdev() function. - added ib_device_get_netdev() to ib_verbs.h.] Signed-off-by: Shivani Agarwal --- drivers/infiniband/core/device.c | 1 + drivers/infiniband/sw/rxe/rxe.c | 23 +++++++++++++++++++---- drivers/infiniband/sw/rxe/rxe.h | 3 ++- drivers/infiniband/sw/rxe/rxe_mcast.c | 22 ++++++++++++++++++++-- drivers/infiniband/sw/rxe/rxe_net.c | 25 ++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.c | 26 +++++++++++++++++++++----- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 ++++++++--- include/rdma/ib_verbs.h | 2 ++ 8 files changed, 93 insertions(+), 20 deletions(-) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/dev= ice.c index 6769c42e46d4..976a771b1f31 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -2254,6 +2254,7 @@ struct net_device *ib_device_get_netdev(struct ib_dev= ice *ib_dev, =20 return res; } +EXPORT_SYMBOL(ib_device_get_netdev); =20 /** * ib_device_get_by_netdev - Find an IB device associated with a netdev diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rx= e.c index 0f8356cea293..1fb4fa4514bf 100644 --- a/drivers/infiniband/sw/rxe/rxe.c +++ b/drivers/infiniband/sw/rxe/rxe.c @@ -40,6 +40,8 @@ void rxe_dealloc(struct ib_device *ib_dev) /* initialize rxe device parameters */ static void rxe_init_device_param(struct rxe_dev *rxe) { + struct net_device *ndev; + rxe->max_inline_data =3D RXE_MAX_INLINE_DATA; =20 rxe->attr.vendor_id =3D RXE_VENDOR_ID; @@ -71,8 +73,15 @@ static void rxe_init_device_param(struct rxe_dev *rxe) rxe->attr.max_fast_reg_page_list_len =3D RXE_MAX_FMR_PAGE_LIST_LEN; rxe->attr.max_pkeys =3D RXE_MAX_PKEYS; rxe->attr.local_ca_ack_delay =3D RXE_LOCAL_CA_ACK_DELAY; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; + addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); + + dev_put(ndev); =20 rxe->max_ucontext =3D RXE_MAX_UCONTEXT; } @@ -109,10 +118,15 @@ static void rxe_init_port_param(struct rxe_port *port) static void rxe_init_ports(struct rxe_dev *rxe) { struct rxe_port *port =3D &rxe->port; + struct net_device *ndev; =20 rxe_init_port_param(port); + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; addrconf_addr_eui48((unsigned char *)&port->port_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); + dev_put(ndev); spin_lock_init(&port->port_lock); } =20 @@ -169,12 +183,13 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int nd= ev_mtu) /* called by ifc layer to create new rxe device. * The caller should allocate memory for rxe by calling ib_alloc_device. */ -int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name) +int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, + struct net_device *ndev) { rxe_init(rxe); rxe_set_mtu(rxe, mtu); =20 - return rxe_register_device(rxe, ibdev_name); + return rxe_register_device(rxe, ibdev_name, ndev); } =20 static int rxe_newlink(const char *ibdev_name, struct net_device *ndev) diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rx= e.h index d8fb2c7af30a..fe7f97066732 100644 --- a/drivers/infiniband/sw/rxe/rxe.h +++ b/drivers/infiniband/sw/rxe/rxe.h @@ -139,7 +139,8 @@ enum resp_states { =20 void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu); =20 -int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name); +int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, + struct net_device *ndev); =20 void rxe_rcv(struct sk_buff *skb); =20 diff --git a/drivers/infiniband/sw/rxe/rxe_mcast.c b/drivers/infiniband/sw/= rxe/rxe_mcast.c index 86cc2e18a7fd..07ff47bae31d 100644 --- a/drivers/infiniband/sw/rxe/rxe_mcast.c +++ b/drivers/infiniband/sw/rxe/rxe_mcast.c @@ -31,10 +31,19 @@ static int rxe_mcast_add(struct rxe_dev *rxe, union ib_gid *mgid) { unsigned char ll_addr[ETH_ALEN]; + struct net_device *ndev; + int ret; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return -ENODEV; =20 ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr); =20 - return dev_mc_add(rxe->ndev, ll_addr); + ret =3D dev_mc_add(ndev, ll_addr); + dev_put(ndev); + + return ret; } =20 /** @@ -47,10 +56,19 @@ static int rxe_mcast_add(struct rxe_dev *rxe, union ib_= gid *mgid) static int rxe_mcast_del(struct rxe_dev *rxe, union ib_gid *mgid) { unsigned char ll_addr[ETH_ALEN]; + struct net_device *ndev; + int ret; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return -ENODEV; =20 ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr); =20 - return dev_mc_del(rxe->ndev, ll_addr); + ret =3D dev_mc_del(ndev, ll_addr); + dev_put(ndev); + + return ret; } =20 /** diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rx= e/rxe_net.c index e5827064ab1e..e2859bbc9a71 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.c +++ b/drivers/infiniband/sw/rxe/rxe_net.c @@ -509,7 +509,16 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, s= truct rxe_av *av, */ const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num) { - return rxe->ndev->name; + struct net_device *ndev; + char *ndev_name; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return NULL; + ndev_name =3D ndev->name; + dev_put(ndev); + + return ndev_name; } =20 int rxe_net_add(const char *ibdev_name, struct net_device *ndev) @@ -521,9 +530,7 @@ int rxe_net_add(const char *ibdev_name, struct net_devi= ce *ndev) if (!rxe) return -ENOMEM; =20 - rxe->ndev =3D ndev; - - err =3D rxe_add(rxe, ndev->mtu, ibdev_name); + err =3D rxe_add(rxe, ndev->mtu, ibdev_name, ndev); if (err) { ib_dealloc_device(&rxe->ib_dev); return err; @@ -571,10 +578,18 @@ void rxe_port_down(struct rxe_dev *rxe) =20 void rxe_set_port_state(struct rxe_dev *rxe) { - if (netif_running(rxe->ndev) && netif_carrier_ok(rxe->ndev)) + struct net_device *ndev; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; + + if (netif_running(ndev) && netif_carrier_ok(ndev)) rxe_port_up(rxe); else rxe_port_down(rxe); + + dev_put(ndev); } =20 static int rxe_notify(struct notifier_block *not_blk, diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/= rxe/rxe_verbs.c index dbb9baa4ffd0..102fc5f56ca7 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -41,6 +41,7 @@ static int rxe_query_port(struct ib_device *ibdev, u32 port_num, struct ib_port_attr *attr) { struct rxe_dev *rxe =3D to_rdev(ibdev); + struct net_device *ndev; int err, ret; =20 if (port_num !=3D 1) { @@ -51,19 +52,26 @@ static int rxe_query_port(struct ib_device *ibdev, =20 memcpy(attr, &rxe->port.attr, sizeof(*attr)); =20 + ndev =3D rxe_ib_device_get_netdev(ibdev); + if (!ndev) { + err =3D -ENODEV; + goto err_out; + } + mutex_lock(&rxe->usdev_lock); ret =3D ib_get_eth_speed(ibdev, port_num, &attr->active_speed, &attr->active_width); =20 if (attr->state =3D=3D IB_PORT_ACTIVE) attr->phys_state =3D IB_PORT_PHYS_STATE_LINK_UP; - else if (dev_get_flags(rxe->ndev) & IFF_UP) + else if (dev_get_flags(ndev) & IFF_UP) attr->phys_state =3D IB_PORT_PHYS_STATE_POLLING; else attr->phys_state =3D IB_PORT_PHYS_STATE_DISABLED; =20 mutex_unlock(&rxe->usdev_lock); =20 + dev_put(ndev); return ret; =20 err_out: @@ -1428,9 +1436,16 @@ static const struct attribute_group rxe_attr_group = =3D { static int rxe_enable_driver(struct ib_device *ib_dev) { struct rxe_dev *rxe =3D container_of(ib_dev, struct rxe_dev, ib_dev); + struct net_device *ndev; + + ndev =3D rxe_ib_device_get_netdev(ib_dev); + if (!ndev) + return -ENODEV; =20 rxe_set_port_state(rxe); - dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(rxe->ndev)); + dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(ndev)); + + dev_put(ndev); return 0; } =20 @@ -1498,7 +1513,8 @@ static const struct ib_device_ops rxe_dev_ops =3D { INIT_RDMA_OBJ_SIZE(ib_mw, rxe_mw, ibmw), }; =20 -int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) +int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name, + struct net_device *ndev) { int err; struct ib_device *dev =3D &rxe->ib_dev; @@ -1510,13 +1526,13 @@ int rxe_register_device(struct rxe_dev *rxe, const = char *ibdev_name) dev->num_comp_vectors =3D num_possible_cpus(); dev->local_dma_lkey =3D 0; addrconf_addr_eui48((unsigned char *)&dev->node_guid, - rxe->ndev->dev_addr); + ndev->dev_addr); =20 dev->uverbs_cmd_mask |=3D BIT_ULL(IB_USER_VERBS_CMD_POST_SEND) | BIT_ULL(IB_USER_VERBS_CMD_REQ_NOTIFY_CQ); =20 ib_set_device_ops(dev, &rxe_dev_ops); - err =3D ib_device_set_netdev(&rxe->ib_dev, rxe->ndev, 1); + err =3D ib_device_set_netdev(&rxe->ib_dev, ndev, 1); if (err) return err; =20 diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/= rxe/rxe_verbs.h index ccb9d19ffe8a..4242b24a47da 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -369,6 +369,7 @@ struct rxe_port { u32 qp_gsi_index; }; =20 +#define RXE_PORT 1 struct rxe_dev { struct ib_device ib_dev; struct ib_device_attr attr; @@ -376,8 +377,6 @@ struct rxe_dev { int max_inline_data; struct mutex usdev_lock; =20 - struct net_device *ndev; - struct rxe_pool uc_pool; struct rxe_pool pd_pool; struct rxe_pool ah_pool; @@ -405,6 +404,11 @@ struct rxe_dev { struct crypto_shash *tfm; }; =20 +static inline struct net_device *rxe_ib_device_get_netdev(struct ib_device= *dev) +{ + return ib_device_get_netdev(dev, RXE_PORT); +} + static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters = index) { atomic64_inc(&rxe->stats_counters[index]); @@ -470,6 +474,7 @@ static inline struct rxe_pd *rxe_mw_pd(struct rxe_mw *m= w) return to_rpd(mw->ibmw.pd); } =20 -int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name); +int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name, + struct net_device *ndev); =20 #endif /* RXE_VERBS_H */ diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index c7e9ec9e9a80..de1d88d41270 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -4444,6 +4444,8 @@ struct net_device *ib_get_net_dev_by_params(struct ib= _device *dev, u32 port, const struct sockaddr *addr); int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, unsigned int port); +struct net_device *ib_device_get_netdev(struct ib_device *ib_dev, + u32 port); struct ib_wq *ib_create_wq(struct ib_pd *pd, struct ib_wq_init_attr *init_attr); int ib_destroy_wq_user(struct ib_wq *wq, struct ib_udata *udata); --=20 2.43.7 From nobody Sun Feb 8 20:34:21 2026 Received: from mail-ot1-f99.google.com (mail-ot1-f99.google.com [209.85.210.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C66AB39A7F7 for ; Thu, 8 Jan 2026 10:26:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.99 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767868019; cv=none; b=Y0HTanA3a+B+2UmuakJPAW3hB1I0yGww9uxuyQhIAMuzIqYfwILWykAl/TystYZ9X2Je93lTXQ3xaeaKtSeltaduTjCK3tE5IjMFgcjV2vvjmb8r7IfiUyPyGSf8k2yW2Cx0Q3bNschW1SXeqEyLDOIxHM152txzVd/NiFhWjAY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767868019; c=relaxed/simple; bh=f31CHMhQWqNlQtDA++NF7UwXwugjtlGMeu/v6z0UZNQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jTF5al+TnvRNbYlhR4/A9HiZyu4GfGO8zsIs0ed2iar10nP5uM3lVnA5XKj6i+NJLkQkk+rZBK6486N8pczLmZJpYW5cUX8b26e51LeuwaV4kaF4ruA9jTm1299/1y/KFrcSwgFAxV58i5WZei8b3vf7eVeZVvDpsZpD0tIe35k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=ezeb+pzh; arc=none smtp.client-ip=209.85.210.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="ezeb+pzh" Received: by mail-ot1-f99.google.com with SMTP id 46e09a7af769-7c75a5cb752so2194320a34.2 for ; Thu, 08 Jan 2026 02:26:52 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767868010; x=1768472810; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bRGzylfuTGBzLuULxrttYZ/W8538Ph4NnSuvcrcPCLg=; b=VRmym0gC10RgY1aXw0hO2o+SDkySp7n42L7K4iyQf9Q/sZ4oSlQfeHD+JLeR3iOHpL xBlC1GbLNJsHWqCxu3dU0dzBflwRYJMIp8kfKBIoMCGObRZSQPrpmUBOLqKnktdY735j eY6r+4hwKNOXAGY5nAxdUjwa5elbw00Y9zEXHQCj/Pk2UcRxye/fCnqakBS3diL37lIo cgkerIOtNJ41yBHYaJZLLrx0SubzUD9vSM7gil+SXDkCCjI/cvyX6cyH2OqJW+utwY7v R1aIzrrlNvkcsh9b3z+BId3s0v2G2UiHGmLKgc0U9Y9bfXxvlghi0BmTI8q2AWcxT4TW qrJw== X-Forwarded-Encrypted: i=1; AJvYcCW8eIjtPpF9lGHIGBGoJzbcLUxL+DhNUaVthiVZQgf6V5edYG5+QZk8dh49rbCqZbH7xmS9nRSjKiRvJ5M=@vger.kernel.org X-Gm-Message-State: AOJu0YyJE0RM9x1VOjFCqLKmsNr7rZmUQG499DELnpcMq4lQ4zkr26QU txbtwYO6URmt3tPQFQzywLYlBxTdbd98vPXVn9NiBH2u3h5C1qM1ry7XxNCLHG3zal9C9b9xv6m PWHL65mHk+uf/94YR7a33sY66/uKGkaxuxva09vFE6lt9WfixGPgABdoKTacDyP6fzyExE9iVz/ 2bg/2/r4eBc6iV/I/E7IMuByVao6CqQ+tJVdZIrPFRWKH/CAXfMz4OXnyljJQXcmtBvnrjASVQC m4V3A9khx9VazNWfUhIv+7lvw== X-Gm-Gg: AY/fxX4E74uX2PzUHgjjk+zPjaBQVLlHgOBKH6ZEwAkDuUcxdgbsdHDys9WYcfRn2WS 00POTMg9FeBZzyRH67KaC28OVgqW/uCIhNtVJTHU7ss6qcDc9La3+BVOLMSreSo5UEui8Z+SOga C77f/eNxaS/Y/CuvSWVVdp2PlSchSl/+ZLs21J5+kFuwrxKtkAWF+/23QkoW65j6obUrhU0nyK1 JSIYTblcSmeD57G+BXM7YAXOXcO1hykere3Lep+Z8JPEuUU5btGLxeGWWluun/Vsz9Dke5s41gT 2eR8ejIhbHVrBAMApxapvIIwl0hF0kFdkGbxbeVb066IFY+UVyO2cvQ5vlEqK9Dv+gLL8TAV0i7 ELtsGR+jxHhvd99HBRclBloupWru9d/5zHzVZlMkczXApBgK13dvvD9dcOVT7fwHHDdO1oq+PQj vAFkRyQYSM10l4MQWfzQ5gHknbwLtJpp9aqxrWtAALVFmFKg== X-Google-Smtp-Source: AGHT+IHq8CQvSHouDrMEPKl0pXwQzFqAD1vePgXXbVipUfyCV7LSn+BnDukE4FT5i5OO//TV+KoyhpA2SitN X-Received: by 2002:a05:6830:4426:b0:7c7:61e0:a4ee with SMTP id 46e09a7af769-7ce508ceac9mr3120506a34.11.1767868010401; Thu, 08 Jan 2026 02:26:50 -0800 (PST) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-1.dlp.protect.broadcom.com. [144.49.247.1]) by smtp-relay.gmail.com with ESMTPS id 46e09a7af769-7ce4788c5c9sm1118926a34.4.2026.01.08.02.26.50 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Jan 2026 02:26:50 -0800 (PST) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-4ffb40c0272so46998971cf.3 for ; Thu, 08 Jan 2026 02:26:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1767868009; x=1768472809; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bRGzylfuTGBzLuULxrttYZ/W8538Ph4NnSuvcrcPCLg=; b=ezeb+pzhg/TTaNLxg+wY5Xs6RFtTL4oZzEkjIbt4LJd3OKKUf6ECcJdY5+ni10+l5L jchx129eOp5S/EVe7LThZQp4AkgCUDFgWfKmcutvguECXarVYMXtq6XrRvaXZGww86ff Vdv63MdhyGuNtHLp4t8M9r7qFdD1iqD/IwxgU= X-Forwarded-Encrypted: i=1; AJvYcCWS43Ii31JPshhZMvOeEqFQW9nplYopNx20CTZYBtIV4yTSp/gY9OloM00u63Bx56cWfDctokemXNVZNbg=@vger.kernel.org X-Received: by 2002:a05:622a:14d3:b0:4f4:c0ac:6666 with SMTP id d75a77b69052e-4ffb4b592e4mr72784701cf.77.1767868009555; Thu, 08 Jan 2026 02:26:49 -0800 (PST) X-Received: by 2002:a05:622a:14d3:b0:4f4:c0ac:6666 with SMTP id d75a77b69052e-4ffb4b592e4mr72784471cf.77.1767868009156; Thu, 08 Jan 2026 02:26:49 -0800 (PST) Received: from shivania.lvn.broadcom.net ([192.19.161.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-4ffa8e362fdsm45124721cf.21.2026.01.08.02.26.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Jan 2026 02:26:48 -0800 (PST) From: Shivani Agarwal To: stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: jgg@ziepe.ca, leon@kernel.org, zyjzyj2000@gmail.com, mbloch@nvidia.com, parav@nvidia.com, mrgolin@amazon.com, roman.gushchin@linux.dev, wangliang74@huawei.com, marco.crivellari@suse.com, zhao.xichao@vivo.com, haggaie@mellanox.com, monis@mellanox.com, dledford@redhat.com, amirv@mellanox.com, kamalh@mellanox.com, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, ajay.kaher@broadcom.com, alexey.makhalov@broadcom.com, vamsi-krishna.brahmajosyula@broadcom.com, yin.ding@broadcom.com, tapas.kundu@broadcom.com, Zhu Yanjun , Daisuke Matsuda , Sasha Levin , Shivani Agarwal Subject: [PATCH 2/2 v6.6] RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests Date: Thu, 8 Jan 2026 02:05:40 -0800 Message-Id: <20260108100540.672666-3-shivani.agarwal@broadcom.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260108100540.672666-1-shivani.agarwal@broadcom.com> References: <20260108100540.672666-1-shivani.agarwal@broadcom.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e Content-Type: text/plain; charset="utf-8" From: Zhu Yanjun [ Upstream commit 8ce2eb9dfac8743d1c423b86339336a5b6a6069e ] In rdma-core, the following failures appear. " $ ./build/bin/run_tests.py -k device ssssssss....FF........s =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device) Test ibv_query_device() Reviewed-by: Daisuke Matsuda Tested-by: Daisuke Matsuda ---------------------------------------------------------------------- Traceback (most recent call last): File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in test_query_device self.verify_device_attr(attr, dev) File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in verify_device_attr assert attr.sys_image_guid !=3D 0 ^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_= ex) Test ibv_query_device_ex() ---------------------------------------------------------------------- Traceback (most recent call last): File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in test_query_device_ex self.verify_device_attr(attr_ex.orig_attr, dev) File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in verify_device_attr assert attr.sys_image_guid !=3D 0 ^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError " The root cause is: before a net device is set with rxe, this net device is used to generate a sys_image_guid. Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device") Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev Reviewed-by: Daisuke Matsuda Tested-by: Daisuke Matsuda Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin [Shivani: Modified to apply on 6.6.y] Signed-off-by: Shivani Agarwal --- drivers/infiniband/sw/rxe/rxe.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rx= e.c index 1fb4fa4514bf..50c583a55464 100644 --- a/drivers/infiniband/sw/rxe/rxe.c +++ b/drivers/infiniband/sw/rxe/rxe.c @@ -38,10 +38,8 @@ void rxe_dealloc(struct ib_device *ib_dev) } =20 /* initialize rxe device parameters */ -static void rxe_init_device_param(struct rxe_dev *rxe) +static void rxe_init_device_param(struct rxe_dev *rxe, struct net_device *= ndev) { - struct net_device *ndev; - rxe->max_inline_data =3D RXE_MAX_INLINE_DATA; =20 rxe->attr.vendor_id =3D RXE_VENDOR_ID; @@ -74,15 +72,9 @@ static void rxe_init_device_param(struct rxe_dev *rxe) rxe->attr.max_pkeys =3D RXE_MAX_PKEYS; rxe->attr.local_ca_ack_delay =3D RXE_LOCAL_CA_ACK_DELAY; =20 - ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); - if (!ndev) - return; - addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, ndev->dev_addr); =20 - dev_put(ndev); - rxe->max_ucontext =3D RXE_MAX_UCONTEXT; } =20 @@ -115,18 +107,13 @@ static void rxe_init_port_param(struct rxe_port *port) /* initialize port state, note IB convention that HCA ports are always * numbered from 1 */ -static void rxe_init_ports(struct rxe_dev *rxe) +static void rxe_init_ports(struct rxe_dev *rxe, struct net_device *ndev) { struct rxe_port *port =3D &rxe->port; - struct net_device *ndev; =20 rxe_init_port_param(port); - ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); - if (!ndev) - return; addrconf_addr_eui48((unsigned char *)&port->port_guid, ndev->dev_addr); - dev_put(ndev); spin_lock_init(&port->port_lock); } =20 @@ -144,12 +131,12 @@ static void rxe_init_pools(struct rxe_dev *rxe) } =20 /* initialize rxe device state */ -static void rxe_init(struct rxe_dev *rxe) +static void rxe_init(struct rxe_dev *rxe, struct net_device *ndev) { /* init default device parameters */ - rxe_init_device_param(rxe); + rxe_init_device_param(rxe, ndev); =20 - rxe_init_ports(rxe); + rxe_init_ports(rxe, ndev); rxe_init_pools(rxe); =20 /* init pending mmap list */ @@ -186,7 +173,7 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev= _mtu) int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, struct net_device *ndev) { - rxe_init(rxe); + rxe_init(rxe, ndev); rxe_set_mtu(rxe, mtu); =20 return rxe_register_device(rxe, ibdev_name, ndev); --=20 2.43.7