Re: [PATCH] RDMA/mlx5: Check SIG_ERR CQE mkey lookup before dereferencing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] rdma/mlx5: un-ratelimited warning in CQ polling loop causes log flood
--

commit c105d16aafdc1a586e27b8a4c8ea42b5926b0203
Author: Li RongQing <lirongqing@baidu.com>

RDMA/mlx5: Check SIG_ERR CQE mkey lookup before dereferencing

This commit adds a NULL check after looking up a signature context in
mlx5_poll_one() to prevent a crash when a memory region is concurrently
deregistered. If the lookup fails, it drops the lock, logs a warning, and
fetches the next completion.

> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index 49b4bf148a4a0..b0b1177077aa0 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -563,6 +563,13 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
>  		xa_lock(&dev->sig_mrs);
>  		sig = xa_load(&dev->sig_mrs,
>  				mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
> +		if (!sig) {
> +			xa_unlock(&dev->sig_mrs);
> +			mlx5_ib_warn(dev, "CQN: 0x%x Got SIGERR on unknown mkey: 0x%x\n",
> +				     cq->mcq.cqn,
> +				     be32_to_cpu(sig_err_cqe->mkey));
> +			goto repoll;

[Severity: Medium]
Could this un-ratelimited warning lead to console flooding and CPU soft
lockups?

A stream of MLX5_CQE_SIG_ERR completions with unknown mkeys (which can be
triggered by remote peers sending invalid data to a registered memory region)
causes mlx5_poll_one() to repeatedly call mlx5_ib_warn() and jump to the
repoll label.

Because goto repoll fetches the next completion queue entry without returning,
it bypasses the CQ polling budget entirely. This could allow a remote attacker
to intentionally stream invalid packets to flood the queue, weaponizing the
loop into a denial of service vector.

Should this use a ratelimited print, and possibly avoid bypassing the polling
budget?

> +		}
>  		get_sig_err_item(sig_err_cqe, &sig->err_item);
>  		sig->sig_err_exists = true;
>  		sig->sigerr_count++;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919100806.2320-1-lirongqing@baidu.com?part=1