[PATCH v3] RDMA/mlx5: Fix CQ resize destination index mask

[PATCH v3] RDMA/mlx5: Fix CQ resize destination index mask

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

In copy_resize_cqes, the destination CQE index is computed as
(i + 1) & cq->resize_buf->nent, but resize_buf->nent is produced by
roundup_pow_of_two(), so it is a power of two with exactly one bit set.
Masking with a single-bit value can only yield 0 or nent itself. The
buffer has nent entries, so valid indices are 0 .. nent - 1 and nent is
one past the last slot; whenever the masked result is nent the following
memcpy writes one entry out of bounds.

Use (nent - 1) as the wrap mask instead. For a power-of-two nent,
(i + 1) & (nent - 1) is the correct modulo-nent reduction, keeping the
index within [0, nent - 1]. This matches get_sw_cqe(), which addresses
the CQ buffer via n & cq->ibcq.cqe, where cq->ibcq.cqe == entries - 1 is
exactly the nent - 1 wrap mask.

Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
Changes in v3:
 Restore the v1 implementation, using (nent - 1) as the wrap mask.

Changes in v2:
 Use modulo (%) instead of a bitmask to wrap the destination CQE index.

 drivers/infiniband/hw/mlx5/cq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index dc457fa..3ade85d 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq)
 
 	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
 		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
-					     (i + 1) & cq->resize_buf->nent);
+					     (i + 1) & (cq->resize_buf->nent - 1));
 		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
 		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
 		memcpy(dcqe, scqe, dsize);
-- 
2.9.4

Re: [PATCH v3] RDMA/mlx5: Fix CQ resize destination index mask

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> In copy_resize_cqes, the destination CQE index is computed as
> (i + 1) & cq->resize_buf->nent, but resize_buf->nent is produced by
> roundup_pow_of_two(), so it is a power of two with exactly one bit set.
> Masking with a single-bit value can only yield 0 or nent itself. The
> buffer has nent entries, so valid indices are 0 .. nent - 1 and nent is
> one past the last slot; whenever the masked result is nent the following
> memcpy writes one entry out of bounds.
> 
> Use (nent - 1) as the wrap mask instead. For a power-of-two nent,
> (i + 1) & (nent - 1) is the correct modulo-nent reduction, keeping the
> index within [0, nent - 1]. This matches get_sw_cqe(), which addresses
> the CQ buffer via n & cq->ibcq.cqe, where cq->ibcq.cqe == entries - 1 is
> exactly the nent - 1 wrap mask.
> 
> Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019050503.2313-1-lirongqing@baidu.com?part=1

Re: [PATCH v3] RDMA/mlx5: Fix CQ resize destination index mask

[Leon Romanovsky]

On Mon, 19 Oct 2026 13:05:03 +0800, lirongqing wrote:
> In copy_resize_cqes, the destination CQE index is computed as
> (i + 1) & cq->resize_buf->nent, but resize_buf->nent is produced by
> roundup_pow_of_two(), so it is a power of two with exactly one bit set.
> Masking with a single-bit value can only yield 0 or nent itself. The
> buffer has nent entries, so valid indices are 0 .. nent - 1 and nent is
> one past the last slot; whenever the masked result is nent the following
> memcpy writes one entry out of bounds.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Fix CQ resize destination index mask
      https://git.kernel.org/rdma/rdma/c/0fe31052d948a3

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>