答复: [????] Re: [PATCH] RDMA/mlx5: Check SIG_ERR CQE mkey lookup before dereferencing

["Li,Rongqing" <lirongqing@baidu.com>]

> On Sat, Sep 19, 2026 at 06:08:06PM +0800, lirongqing wrote:
> > From: Li RongQing <lirongqing@baidu.com>
> >
> > In mlx5_poll_one, a MLX5_CQE_SIG_ERR completion looks up the signature
> > context in dev->sig_mrs via xa_load() but dereferences the result
> > without a NULL check. If the corresponding MR has been concurrently
> > deregistered
> 
> Is this real scenario? Integrity MRs are in-kernel MRs, they shouldn't be
> concurrently deregistered.
> 
Thanks for the review. You're right ― the concurrent-deregister scenario I described is not reachable in normal use: MLX5_CQE_SIG_ERR is only generated for signature (IB_MR_TYPE_INTEGRITY) MRs, whose mkey is always present in dev->sig_mrs while the operation is in flight, and the null mkey is an ODP-only special case that is never inserted into sig_mrs.

Thanks

[Li,Rongqing] 


> Thanks
> 
> > (which removes the xarray entry without holding the CQ lock),
> > xa_load() returns NULL and the subsequent
> > get_sig_err_item(sig_err_cqe, &sig->err_item) crashes in atomic context under
> xa_lock.
> >
> > Add a NULL check that drops the lock, logs a warning, and repolls.
> >
> > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > ---
> >  drivers/infiniband/hw/mlx5/cq.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/infiniband/hw/mlx5/cq.c
> > b/drivers/infiniband/hw/mlx5/cq.c index 49b4bf1..b0b1177 100644
> > --- a/drivers/infiniband/hw/mlx5/cq.c
> > +++ b/drivers/infiniband/hw/mlx5/cq.c
> > @@ -563,6 +563,13 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
> >  		xa_lock(&dev->sig_mrs);
> >  		sig = xa_load(&dev->sig_mrs,
> >  				mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
> > +		if (!sig) {
> > +			xa_unlock(&dev->sig_mrs);
> > +			mlx5_ib_warn(dev, "CQN: 0x%x Got SIGERR on unknown mkey:
> 0x%x\n",
> > +				     cq->mcq.cqn,
> > +				     be32_to_cpu(sig_err_cqe->mkey));
> > +			goto repoll;
> > +		}
> >  		get_sig_err_item(sig_err_cqe, &sig->err_item);
> >  		sig->sig_err_exists = true;
> >  		sig->sigerr_count++;
> > --
> > 2.9.4
> >