[PATCH 01/16] NTB: ntb_transport: Abort link setup on QP MW allocation failure

[Koichiro Den]

ntb_transport_setup_qp_mw() can fail while growing a QP's RX entry pool,
but the link worker ignores that error. The worker can then publish a QP
whose memory-window state is only partly initialized, and later work can
use stale or incomplete pointers.

Set up every QP memory window before publishing the transport link. On
failure, clear the QP pointers before releasing its MW backing and leave
the link down.

Fixes: a754a8fcaf38 ("NTB: allocate number transport entries depending on size of ring size")
Signed-off-by: Koichiro Den <den@xxxxxxxxxxxxx>
---
 drivers/ntb/ntb_transport.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index f59f926d4bfa..3efc50955253 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1084,14 +1084,19 @@ static void ntb_transport_link_work(struct work_struct *work)
 			goto out1;
 	}
 
-	nt->link_is_up = true;
+	nt->link_is_up = false;
+	for (i = 0; i < nt->qp_count; i++) {
+		rc = ntb_transport_setup_qp_mw(nt, i);
+		if (rc)
+			goto out1;
+		ntb_transport_setup_qp_peer_msi(nt, i);
+	}
 
+	/* Publish the link only after every QP has been set up. */
+	nt->link_is_up = true;
 	for (i = 0; i < nt->qp_count; i++) {
 		struct ntb_transport_qp *qp = &nt->qp_vec[i];
 
-		ntb_transport_setup_qp_mw(nt, i);
-		ntb_transport_setup_qp_peer_msi(nt, i);
-
 		if (qp->client_ready)
 			schedule_delayed_work(&qp->link_work, 0);
 	}
@@ -1099,6 +1104,13 @@ static void ntb_transport_link_work(struct work_struct *work)
 	return;
 
 out1:
+	for (i = 0; i < nt->qp_count; i++) {
+		struct ntb_transport_qp *qp = &nt->qp_vec[i];
+
+		qp->rx_buff = NULL;
+		qp->remote_rx_info = NULL;
+	}
+
 	for (i = 0; i < nt->mw_count; i++)
 		ntb_free_mw(nt, i);
 
-- 
2.51.0