| From d3bce9ff66d5a3e4ec699ea4ec1fe91c3791156c Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 22 Mar 2021 14:35:32 +0100 |
| Subject: RDMA/core: Fix corrupted SL on passive side |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Håkon Bugge <haakon.bugge@oracle.com> |
| |
| [ Upstream commit 194f64a3cad3ab9e381e996a13089de3215d1887 ] |
| |
| On RoCE systems, a CM REQ contains a Primary Hop Limit > 1 and Primary |
| Subnet Local is zero. |
| |
| In cm_req_handler(), the cm_process_routed_req() function is called. Since |
| the Primary Subnet Local value is zero in the request, and since this is |
| RoCE (Primary Local LID is permissive), the following statement will be |
| executed: |
| |
| IBA_SET(CM_REQ_PRIMARY_SL, req_msg, wc->sl); |
| |
| This corrupts SL in req_msg if it was different from zero. In other words, |
| a request to setup a connection using an SL != zero, will not be honored, |
| and a connection using SL zero will be created instead. |
| |
| Fixed by not calling cm_process_routed_req() on RoCE systems, the |
| cm_process_route_req() is only for IB anyhow. |
| |
| Fixes: 3971c9f6dbf2 ("IB/cm: Add interim support for routed paths") |
| Link: https://lore.kernel.org/r/1616420132-31005-1-git-send-email-haakon.bugge@oracle.com |
| Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> |
| Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/core/cm.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c |
| index 3d194bb60840..6adbaea358ae 100644 |
| --- a/drivers/infiniband/core/cm.c |
| +++ b/drivers/infiniband/core/cm.c |
| @@ -2138,7 +2138,8 @@ static int cm_req_handler(struct cm_work *work) |
| goto destroy; |
| } |
| |
| - cm_process_routed_req(req_msg, work->mad_recv_wc->wc); |
| + if (cm_id_priv->av.ah_attr.type != RDMA_AH_ATTR_TYPE_ROCE) |
| + cm_process_routed_req(req_msg, work->mad_recv_wc->wc); |
| |
| memset(&work->path[0], 0, sizeof(work->path[0])); |
| if (cm_req_has_alt_path(req_msg)) |
| -- |
| 2.30.2 |
| |
