RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list

If the host buffers are freed before destroying MR in HW,
HW could try accessing these buffers. This could cause a host
crash. Fixing the code to avoid this condition.

Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 169798752895019906ac1ef3e00f793382c84a94..d94b1b3041359c5f06e9c29aae4fe8bf57934dca 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -3052,6 +3052,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
        struct bnxt_re_dev *rdev = mr->rdev;
        int rc;
 
+       rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+       if (rc) {
+               dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+               return rc;
+       }
+
        if (mr->npages && mr->pages) {
                rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                        &mr->qplib_frpl);
@@ -3059,8 +3065,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                mr->npages = 0;
                mr->pages = NULL;
        }
-       rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-
        if (!IS_ERR_OR_NULL(mr->ib_umem))
                ib_umem_release(mr->ib_umem);