Re: [PATCH rdma-next v3] RDMA/mlx5: quiesce CQ polling before device shutdown on reboot

[Leon Romanovsky <leon@kernel.org>]

On Wed, Jul 15, 2026 at 04:23:07PM +0800, Chenguang Zhao wrote:
> From: Chenguang Zhao <zhaochenguang@kylinos.cn>
> 
> On reboot -f with NFS over RDMA, mlx5 shutdown can tear the device
> down while ib-comp-wq still polls live CQs, leading to UAF in
> wr_cqe->done().
> 
> Mark the device shutting down before teardown, flush completion
> workqueues so in-flight pollers observe the flag, skip SYS_ERROR
> completion delivery, and make poll/arm CQ a no-op under the CQ lock
> while shutting down.
> 
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> ---
> changelog:
>  - Fix the race on MLX5_INTERFACE_STATE_SHUTTING_DOWN: set the
>    flag, then flush ib-comp / mlx5_ib event workqueues via an
>    mlx5_ib quiesce hook before fast_unload/teardown.
>  - Check shutting-down under cq->lock in mlx5_ib_poll_cq/arm_cq.
>  - Export ib_comp_wq and ib_comp_unbound_wq so modular mlx5_ib
>    can flush them.
> 
> v2:
>  https://lore.kernel.org/all/20260714075558.1420384-1-chenguang.zhao@linux.dev/
> 
> v1:
>  https://lore.kernel.org/all/20260702073422.279820-1-chenguang.zhao@linux.dev/
> 
>  drivers/infiniband/core/device.c              |  2 ++
>  drivers/infiniband/hw/mlx5/cq.c               | 11 ++++++++++
>  drivers/infiniband/hw/mlx5/main.c             | 20 +++++++++++++++++++
>  .../net/ethernet/mellanox/mlx5/core/health.c  |  3 +++
>  .../net/ethernet/mellanox/mlx5/core/main.c    | 10 ++++++++++
>  .../mellanox/mlx5/core/sf/dev/driver.c        |  3 +++
>  include/linux/mlx5/driver.h                   | 11 ++++++++++
>  7 files changed, 60 insertions(+)

<...>

> +static void mlx5_ib_shutdown_quiesce(void)
> +{
> +	flush_workqueue(ib_comp_wq);
> +	flush_workqueue(ib_comp_unbound_wq);
> +	flush_workqueue(mlx5_ib_event_wq);
> +}

These workqueues are shared by all IB drivers and the core. Drivers
must not flush or destroy them.

Why this is not FW issue?

Thanks