Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[Leon Romanovsky <leon@kernel.org>]

On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> In copy_resize_cqes, the destination CQE index is computed as
> (i + 1) & cq->resize_buf->nent, but resize_buf->nent is the power-of-two
> entry count, so the mask only yields 0 or nent -- and nent is one past the
> last valid slot. The following memcpy then writes out of bounds.
> 
> Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which masks
> against cq->ibcq.cqe (the nent - 1 value).
> 
> Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/hw/mlx5/cq.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index b0b1177..5bd5227 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq)
>  
>  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
>  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> -					     (i + 1) & cq->resize_buf->nent);
> +					     (i + 1) & (cq->resize_buf->nent - 1));

I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.

Thanks

>  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
>  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
>  		memcpy(dcqe, scqe, dsize);
> -- 
> 2.9.4
>