RDMA/mlx5: Fix cache entry update on dereg error

JIRA: https://issues.redhat.com/browse/RHEL-72227
JIRA: https://issues.redhat.com/browse/RHEL-73520
Upstream-status: v6.15-rc1
Conflicts:
- drivers/infiniband/hw/mlx5/mr.c
	Due to the backport of
	cc668a1 RDMA/mlx5: Fix a race for DMABUF MR which can lead to CQE with error (v6.14-rc5)
	-> Adjust context, use resolution found in merge commit
	092e335 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma (v6.15-rc1)

commit 24d693c
Author: Michael Guralnik <michaelgur@nvidia.com>
Date:   Thu Mar 13 16:29:49 2025 +0200

    RDMA/mlx5: Fix cache entry update on dereg error

    Fix double decrement of 'in_use' counter on push_mkey_locked() failure
    while deregistering an MR.
    If we fail to return an mkey to the cache in cache_ent_find_and_store()
    it'll update the 'in_use' counter. Its caller, revoke_mr(), also updates
    it, thus having double decrement.

    Wrong value of 'in_use' counter will be exposed through debugfs and can
    also cause wrong resizing of the cache when users try to set cache
    entry size using the 'size' debugfs.

    To address this issue, the 'in_use' counter is now decremented within
    mlx5_revoke_mr() also after a successful call to
    cache_ent_find_and_store() and not within cache_ent_find_and_store().
    Other success or failure flows remains unchanged where it was also
    decremented.

    Fixes: 8c1185f ("RDMA/mlx5: Change check for cacheable mkeys")
    Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
    Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
    Link: https://patch.msgid.link/97e979dff636f232ff4c83ce709c17c727da1fdb.1741875692.git.leon@kernel.org
    Signed-off-by: Leon Romanovsky <leon@kernel.org>

Signed-off-by: Benjamin Poirier <bpoirier@redhat.com>

Author: Benjamin Poirier

drivers/infiniband/hw/mlx5/mr.c

@@ -1968,7 +1968,6 @@ static int cache_ent_find_and_store(struct mlx5_ib_dev *dev,
 
 	if (mr->mmkey.cache_ent) {
 		spin_lock_irq(&mr->mmkey.cache_ent->mkeys_queue.lock);
-		mr->mmkey.cache_ent->in_use--;
 		goto end;
 	}
 
@@ -2036,6 +2035,7 @@ static int mlx5_revoke_mr(struct mlx5_ib_mr *mr)
 	bool is_odp = is_odp_mr(mr);
 	bool is_odp_dma_buf = is_dmabuf_mr(mr) &&
 			!to_ib_umem_dmabuf(mr->umem)->pinned;
+	bool from_cache = !!ent;
 	int ret = 0;
 
 	if (is_odp)
@@ -2048,6 +2048,8 @@ static int mlx5_revoke_mr(struct mlx5_ib_mr *mr)
 		ent = mr->mmkey.cache_ent;
 		/* upon storing to a clean temp entry - schedule its cleanup */
 		spin_lock_irq(&ent->mkeys_queue.lock);
+		if (from_cache)
+			ent->in_use--;
 		if (ent->is_tmp && !ent->tmp_cleanup_scheduled) {
 			mod_delayed_work(ent->dev->cache.wq, &ent->dwork,
 					 msecs_to_jiffies(30 * 1000));