Re: [PATCH for-next v2 2/2] RDMA/bnxt_re: Add uverbs object handle path for CQ/SRQ toggle page

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Jun 24, 2026 at 03:39:27PM -0700, Selvin Xavier wrote:
> +		} else {
> +			/*
> +			 * Legacy path: old libbnxt_re sends TYPE + RES_ID.
> +			 * Look up the CQ or SRQ in the per-context XArray
> +			 */
> +			enum bnxt_re_get_toggle_mem_type res_type;
> +			u32 res_id;
> +
> +			err = uverbs_get_const(&res_type, attrs,
> +					       BNXT_RE_TOGGLE_MEM_TYPE);
> +			if (err)
> +				return err;
> +			err = uverbs_copy_from(&res_id, attrs,
> +					       BNXT_RE_TOGGLE_MEM_RES_ID);
> +			if (err)
> +				return err;
> +
> +			if (res_type == BNXT_RE_CQ_TOGGLE_MEM) {
> +				struct bnxt_re_cq *cq;
> +
> +				xa_lock(&uctx->cq_xa);
> +				cq = xa_load(&uctx->cq_xa, res_id);
> +				if (cq)
> +					addr = (u64)cq->uctx_cq_page;
> +				xa_unlock(&uctx->cq_xa);

Does this have the same basic UAF issue on addr?

Can you change this around so it tracks the uobject in the xarray an
uses proper uobject locking consistently in both legs?

If I understand this right it should also be holding onto a refcount
of the uobject while the toggle mem exists to ensure it doesn't free
in the wrong order?

Jason