* [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown
@ 2026-10-07 23:42 Prathamesh Deshpande
2026-10-07 23:56 ` sashiko-bot
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Prathamesh Deshpande @ 2026-10-07 23:42 UTC (permalink / raw)
To: Leon Romanovsky, Tariq Toukan, Saeed Mahameed, Jason Gunthorpe,
linux-rdma, linux-kernel
Cc: saeedm, tariqt, Prathamesh Deshpande
Page-fault EQ work can remain queued after the notifier is disabled.
Destroying the EQ before cancelling that work can let the worker access
freed EQ memory.
Cancel the deferred work before destroying the EQ.
Fixes: d5d284b829a6 ("{net,IB}/mlx5: Move Page fault EQ and ODP logic to RDMA")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
drivers/infiniband/hw/mlx5/odp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index b8618610737a..1f28c30095dc 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1885,8 +1885,8 @@ mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
if (!eq->core)
return 0;
mlx5_eq_disable(dev->mdev, eq->core, &eq->irq_nb);
- err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
cancel_work_sync(&eq->work);
+ err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
destroy_workqueue(eq->wq);
mempool_destroy(eq->pool);
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown
2026-10-07 23:42 [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown Prathamesh Deshpande
@ 2026-10-07 23:56 ` sashiko-bot
2026-10-08 5:47 ` Chenguang Zhao
2026-10-12 7:30 ` Leon Romanovsky
2 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-10-07 23:56 UTC (permalink / raw)
To: Prathamesh Deshpande; +Cc: linux-rdma
> Page-fault EQ work can remain queued after the notifier is disabled.
> Destroying the EQ before cancelling that work can let the worker access
> freed EQ memory.
>
> Cancel the deferred work before destroying the EQ.
>
> Fixes: d5d284b829a6 ("{net,IB}/mlx5: Move Page fault EQ and ODP logic to RDMA")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261007234216.2765-1-prathameshdeshpande7@gmail.com?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown
2026-10-07 23:42 [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown Prathamesh Deshpande
2026-10-07 23:56 ` sashiko-bot
@ 2026-10-08 5:47 ` Chenguang Zhao
2026-10-12 7:30 ` Leon Romanovsky
2 siblings, 0 replies; 4+ messages in thread
From: Chenguang Zhao @ 2026-10-08 5:47 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: Leon Romanovsky, Tariq Toukan, Saeed Mahameed, Jason Gunthorpe,
linux-rdma, linux-kernel, saeedm, tariqt
On Thu, Oct 08, 2026 at 12:42:11AM +0100, Prathamesh Deshpande wrote:
> Page-fault EQ work can remain queued after the notifier is disabled.
> Destroying the EQ before cancelling that work can let the worker access
> freed EQ memory.
>
> Cancel the deferred work before destroying the EQ.
>
> Fixes: d5d284b829a6 ("{net,IB}/mlx5: Move Page fault EQ and ODP logic to RDMA")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> drivers/infiniband/hw/mlx5/odp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
> index b8618610737a..1f28c30095dc 100644
> --- a/drivers/infiniband/hw/mlx5/odp.c
> +++ b/drivers/infiniband/hw/mlx5/odp.c
> @@ -1885,8 +1885,8 @@ mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
> if (!eq->core)
> return 0;
> mlx5_eq_disable(dev->mdev, eq->core, &eq->irq_nb);
> - err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
> cancel_work_sync(&eq->work);
> + err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
> destroy_workqueue(eq->wq);
> mempool_destroy(eq->pool);
>
> --
> 2.43.0
>
Looks correct.
Reviewed-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown
2026-10-07 23:42 [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown Prathamesh Deshpande
2026-10-07 23:56 ` sashiko-bot
2026-10-08 5:47 ` Chenguang Zhao
@ 2026-10-12 7:30 ` Leon Romanovsky
2 siblings, 0 replies; 4+ messages in thread
From: Leon Romanovsky @ 2026-10-12 7:30 UTC (permalink / raw)
To: Tariq Toukan, Saeed Mahameed, Jason Gunthorpe, linux-rdma,
linux-kernel, Prathamesh Deshpande
Cc: saeedm, tariqt
On Thu, 08 Oct 2026 00:42:11 +0100, Prathamesh Deshpande wrote:
> Page-fault EQ work can remain queued after the notifier is disabled.
> Destroying the EQ before cancelling that work can let the worker access
> freed EQ memory.
>
> Cancel the deferred work before destroying the EQ.
>
>
> [...]
Applied, thanks!
[1/1] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown
https://git.kernel.org/rdma/rdma/c/aea64024ac37d2
Best regards,
--
Leon Romanovsky <leon@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-12 7:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-07 23:42 [PATCH rdma] RDMA/mlx5: Cancel deferred page-fault EQ work before teardown Prathamesh Deshpande
2026-10-07 23:56 ` sashiko-bot
2026-10-08 5:47 ` Chenguang Zhao
2026-10-12 7:30 ` Leon Romanovsky
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.