答复: [????] Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

["Li,Rongqing" <lirongqing@baidu.com>]

> On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> > From: Li RongQing <lirongqing@baidu.com>
> >
> > In copy_resize_cqes, the destination CQE index is computed as (i + 1)
> > & cq->resize_buf->nent, but resize_buf->nent is the power-of-two entry
> > count, so the mask only yields 0 or nent -- and nent is one past the
> > last valid slot. The following memcpy then writes out of bounds.
> >
> > Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which
> > masks against cq->ibcq.cqe (the nent - 1 value).
> >
> > Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > ---
> >  drivers/infiniband/hw/mlx5/cq.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/hw/mlx5/cq.c
> > b/drivers/infiniband/hw/mlx5/cq.c index b0b1177..5bd5227 100644
> > --- a/drivers/infiniband/hw/mlx5/cq.c
> > +++ b/drivers/infiniband/hw/mlx5/cq.c
> > @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq
> > *cq)
> >
> >  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
> >  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> > -					     (i + 1) & cq->resize_buf->nent);
> > +					     (i + 1) & (cq->resize_buf->nent - 1));
> 
> I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.
> 
> Thanks

resize_buf->nent is guaranteed to be a power of two by roundup_pow_of_two(entries + 1), 
and sw_ownership_bit()/get_sw_cqe() in the same path both rely on this invariant.
Therefore & (nent - 1) and % nent are equivalent here; the bitwise form is kept for consistency
with the surrounding code.

Thanks

[Li,Rongqing] 



> 
> >  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
> >  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
> >  		memcpy(dcqe, scqe, dsize);
> > --
> > 2.9.4
> >