From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f181.google.com (mail-qk1-f181.google.com [209.85.222.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A0333AA9D8 for ; Fri, 16 Oct 2026 04:59:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792126764; cv=none; b=ksS8tSOxQ5KXmwRE0mkcOMRE47lYAfHftDVn52yEEBV31SQ19AacBLqT9AZAz196ZwSbKzeqUMJdoKOHjHEargdKseqtJLu9/2S80V7bjOoB2NjiXuQPortSv93qnYeoWFd4vICOYoyPcMC1cTDuSfF69N125SAFEGd9cxJLH5A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792126764; c=relaxed/simple; bh=EDqH+UtMu9lLfpvEqam2Dre/TtwJRJkTG1q+T7HLHiI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FzPRtBKqRVH8cRIQATrXdX+Ig6xvn9ukdGoa2XopV1dxYeVAiVto5WMKqPKMqQTrpmIbXU1wD3kEBKR150KnARQbTrYjQzELzDqgWOivg3AMuT0Lj2E+qDlP2xUncX9YZ6VrlK+qOiFHKNcQ2v7DcuetdE1rrvjEmxZLRD51Gfw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ITjleeO6; arc=none smtp.client-ip=209.85.222.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ITjleeO6" Received: by mail-qk1-f181.google.com with SMTP id af79cd13be357-93e6fb35f91so565196885a.2 for ; Thu, 15 Oct 2026 21:59:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792126762; x=1792731562; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YXMmAjVIKkIpvClePKCqZRvItWuOvpeYbF8NBgtQiLs=; b=ITjleeO6OJUB3L02RHa9imrSRZZ2I7Mz/mKxiDrEpcUDsWG50hExjpHwGN/NcxRbuH aDznMOQXxGe2XC2iKqm7mZKYh5NcPW0W0TWvPENhG7p5hJe34ufFbMbSP0Yo5gGQ5FMU eMmnpAaesoO8NhClZQjgOgxHkqpOaD1IaAXEYuGaAkIYvZfJGo3sBGMszrAFalk3vZ7R sxfXEc2BK8oJaDmpq2D0eUHjxa/bP/xfUONOIfoIUalsmzYCPAySXNJnhMlt1jUSqmpF qCfaQBppOAiZj6PbEVrx26HmBcD+keofu2ioR+p2jbbLcBKw7C7KVlpjGlirlpn1YSTe 2LOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792126762; x=1792731562; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YXMmAjVIKkIpvClePKCqZRvItWuOvpeYbF8NBgtQiLs=; b=phI9tjfw2bXOASoiyYxoHWHpWmFagw79wuBnRjVRe1EzMKxYGZEP8s+G/ZLzovvN8u tjXDfhI8qUcHDWrfLaEBEmuY/GPHYcJml+duZevkPOLZmY0MTqPbAs8TULn2pgsLMZVt EQ4V4FEc9cNOyqEGAqRR9MRwG6FrNEzGauOYzlEufXr9VixzQHNnSXVr96PLpQpe13/n Q4f6A47G5vbRTBbkC6ikdqg8ilf0NYxDZC2MHaaJO01H/VQ++pE59X5VQC84YlY7/37i 2IhnqydFRyILcNUqG6DzcQ26l9t1E0CUXoBbFZzqftnRtz2skML8VJ97Asm9vCZ+C8ef txPQ== X-Forwarded-Encrypted: i=1; AKwUvByJA1M6GPWSdGJFtQhdZKDWNNEKYoqggD2OMAcELd0uZpe/jaq75gRtIqAuI1k1voxQjS1Bh1kr3Hg0JaQ=@vger.kernel.org X-Gm-Message-State: AFq9FYI4XR/SQ/dUxepnBQr85WHlvQMI3fQ/gZkCb+VoEE+SWOtMIs3Z /Br1GanRxj9LuQN5U1jljH9Q1TcH10aO2ZT70xxdiAtkYAhH0pkA/j8Y X-Gm-Gg: AYBFou1Tub+1LZI3TskwD52xBjJp2Zw9J5WG4MBZoZGwk9SmglEeoLmEwKAXYlAMmfx BDxkOI+ggTRbx9xmE1HCphnrEGoJzPgM9cagSSbytuZm/Kq8f1w26ukTvu9dsseYxAjsIPBqlsw FyRAT4nAm/LWJdXfdWOOlRybbylyS/v4f0U5DqBzcf3IDm/ofEFuJzRFbSnJFxYxTRjtEXz+RR0 3EgIU49HJgclzX7201367931H/Xe2l6BzWonaDKJlkRn5i8MfT5mfP6TUCs230jrDCrM0gPhNAb 8C1iHFx7AofZ/2S+am+LlLA5BHIo7sNoEJ4z+JJH9g0FfHBoJsYrLr1FgpzDEfNNW01dG8vDtN+ wdXL/ZoQTE5xSBv4pl7cxiims3Ony0YXm6hg8pEJGyDlUrp/8j8g1QXD4v+4diEWc60erqYbR7t cTky32PyikL5RXbA93mZ0+WNakQNUnw+e8P8+lSrMf1JfmJ81kvRzAKhSOGo2rjALnT2F4NfM2h 2sXzKKO0sDxHz9oUnY8DCWm5EHu9tPY X-Received: by 2002:a05:620a:198d:b0:93e:942f:b8ae with SMTP id af79cd13be357-93ebd1dfff5mr3416433185a.26.1792126761933; Thu, 15 Oct 2026 21:59:21 -0700 (PDT) Received: from i4-gl-tmk5904.ad.psu.edu ([130.203.156.186]) by smtp.gmail.com with ESMTPSA id af79cd13be357-93f1a198372sm118038685a.27.2026.10.15.21.59.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Oct 2026 21:59:21 -0700 (PDT) From: Yuho Choi To: Saeed Mahameed , Leon Romanovsky , Tariq Toukan , Mark Bloch Cc: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Ariel Levkovich , Jianbo Liu , Alex Vesker , Yevgeny Kliteynik , Itamar Gozlan , netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Yuho Choi Subject: [PATCH net-next v1 3/4] net/mlx5: DR, Don't free the send ring CQ if destroying it fails Date: Fri, 16 Oct 2026 00:57:48 -0400 Message-ID: <20261016045849.813696-9-oss.patchbox@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261016045849.813696-6-oss.patchbox@gmail.com> References: <20261016045849.813696-6-oss.patchbox@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dr_destroy_cq() ignores the result of mlx5_core_destroy_cq() and frees the CQ buffer, doorbell record and struct mlx5dr_cq anyway. If DESTROY_CQ fails, the CQ may still exist in firmware and retain access to its buffer and doorbell record. mlx5_core_destroy_cq() also returns early in that case, without waiting for EQ handlers that may already hold a reference to the CQ. Keep the CQ and its buffer when DESTROY_CQ fails, as the regular mlx5_ib CQ destroy path does. A device in internal error is not affected, since the mlx5 core reports success for DESTROY_CQ in that state. Fixes: 297cccebdc5a ("net/mlx5: DR, Expose an internal API to issue RDMA operations") Assisted-by: LLM Signed-off-by: Yuho Choi --- This was found with a static analysis tool from ongoing, not yet published research, and confirmed by code inspection. It has not been reproduced on hardware. .../net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c index 79e3c29d1044e..8fc41adb4c756 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c @@ -1130,7 +1130,9 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, static void dr_destroy_cq(struct mlx5_core_dev *mdev, struct mlx5dr_cq *cq) { - mlx5_core_destroy_cq(mdev, &cq->mcq); + /* The device may still use an undestroyed CQ; keep it. */ + if (mlx5_core_destroy_cq(mdev, &cq->mcq)) + return; mlx5_wq_destroy(&cq->wq_ctrl); kfree(cq); } -- 2.43.0