Re: [PATCH rdma-next v1] RDMA/mlx5: Fix implicit ODP use after free

[Jason Gunthorpe <jgg@nvidia.com>]

On Sun, Jan 19, 2025 at 10:21:41AM +0200, Leon Romanovsky wrote:
> From: Patrisious Haddad <phaddad@nvidia.com>
> 
> Prevent double queueing of implicit ODP mr destroy work by using
> __xa_cmpxchg() to make sure, this is the first and last time we are
> destroying this specific mr.
> 
> Without this change, we could try to invalidate this mr twice, which in
> turn could result in queuing a MR work destroy twice, and eventually the
> second work could execute after the MR was freed due to the first work,
> causing a user after free and trace below.
> 

>  drivers/infiniband/hw/mlx5/odp.c | 25 ++++++++++++++++---------
>  1 file changed, 16 insertions(+), 9 deletions(-)

Applied to for-next with the change I noted

Thanks,
Jason