[PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

In copy_resize_cqes, the destination CQE index is computed as
(i + 1) & cq->resize_buf->nent, but resize_buf->nent is the power-of-two
entry count, so the mask only yields 0 or nent -- and nent is one past the
last valid slot. The following memcpy then writes out of bounds.

Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which masks
against cq->ibcq.cqe (the nent - 1 value).

Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/hw/mlx5/cq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index b0b1177..5bd5227 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq)
 
 	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
 		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
-					     (i + 1) & cq->resize_buf->nent);
+					     (i + 1) & (cq->resize_buf->nent - 1));
 		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
 		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
 		memcpy(dcqe, scqe, dsize);
-- 
2.9.4

Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> In copy_resize_cqes, the destination CQE index is computed as
> (i + 1) & cq->resize_buf->nent, but resize_buf->nent is the power-of-two
> entry count, so the mask only yields 0 or nent -- and nent is one past the
> last valid slot. The following memcpy then writes out of bounds.
> 
> Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which masks
> against cq->ibcq.cqe (the nent - 1 value).
> 
> Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919100716.2221-1-lirongqing@baidu.com?part=1

Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[Leon Romanovsky]

On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> In copy_resize_cqes, the destination CQE index is computed as
> (i + 1) & cq->resize_buf->nent, but resize_buf->nent is the power-of-two
> entry count, so the mask only yields 0 or nent -- and nent is one past the
> last valid slot. The following memcpy then writes out of bounds.
> 
> Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which masks
> against cq->ibcq.cqe (the nent - 1 value).
> 
> Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/hw/mlx5/cq.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index b0b1177..5bd5227 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq)
>  
>  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
>  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> -					     (i + 1) & cq->resize_buf->nent);
> +					     (i + 1) & (cq->resize_buf->nent - 1));

I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.

Thanks

>  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
>  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
>  		memcpy(dcqe, scqe, dsize);
> -- 
> 2.9.4
> 

答复: [????] Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[Li,Rongqing]

> On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> > From: Li RongQing <lirongqing@baidu.com>
> >
> > In copy_resize_cqes, the destination CQE index is computed as (i + 1)
> > & cq->resize_buf->nent, but resize_buf->nent is the power-of-two entry
> > count, so the mask only yields 0 or nent -- and nent is one past the
> > last valid slot. The following memcpy then writes out of bounds.
> >
> > Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which
> > masks against cq->ibcq.cqe (the nent - 1 value).
> >
> > Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > ---
> >  drivers/infiniband/hw/mlx5/cq.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/hw/mlx5/cq.c
> > b/drivers/infiniband/hw/mlx5/cq.c index b0b1177..5bd5227 100644
> > --- a/drivers/infiniband/hw/mlx5/cq.c
> > +++ b/drivers/infiniband/hw/mlx5/cq.c
> > @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq
> > *cq)
> >
> >  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
> >  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> > -					     (i + 1) & cq->resize_buf->nent);
> > +					     (i + 1) & (cq->resize_buf->nent - 1));
> 
> I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.
> 
> Thanks

resize_buf->nent is guaranteed to be a power of two by roundup_pow_of_two(entries + 1), 
and sw_ownership_bit()/get_sw_cqe() in the same path both rely on this invariant.
Therefore & (nent - 1) and % nent are equivalent here; the bitwise form is kept for consistency
with the surrounding code.

Thanks

[Li,Rongqing] 



> 
> >  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
> >  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
> >  		memcpy(dcqe, scqe, dsize);
> > --
> > 2.9.4
> >

Re: 答复: [????] Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[Leon Romanovsky]

On Tue, Sep 29, 2026 at 01:06:18AM +0000, Li,Rongqing wrote:
> > On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> > > From: Li RongQing <lirongqing@baidu.com>
> > >
> > > In copy_resize_cqes, the destination CQE index is computed as (i + 1)
> > > & cq->resize_buf->nent, but resize_buf->nent is the power-of-two entry
> > > count, so the mask only yields 0 or nent -- and nent is one past the
> > > last valid slot. The following memcpy then writes out of bounds.
> > >
> > > Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which
> > > masks against cq->ibcq.cqe (the nent - 1 value).
> > >
> > > Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> > > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > > ---
> > >  drivers/infiniband/hw/mlx5/cq.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/infiniband/hw/mlx5/cq.c
> > > b/drivers/infiniband/hw/mlx5/cq.c index b0b1177..5bd5227 100644
> > > --- a/drivers/infiniband/hw/mlx5/cq.c
> > > +++ b/drivers/infiniband/hw/mlx5/cq.c
> > > @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq
> > > *cq)
> > >
> > >  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
> > >  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> > > -					     (i + 1) & cq->resize_buf->nent);
> > > +					     (i + 1) & (cq->resize_buf->nent - 1));
> > 
> > I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.
> > 
> > Thanks
> 
> resize_buf->nent is guaranteed to be a power of two by roundup_pow_of_two(entries + 1), 
> and sw_ownership_bit()/get_sw_cqe() in the same path both rely on this invariant.
> Therefore & (nent - 1) and % nent are equivalent here; the bitwise form is kept for consistency
> with the surrounding code.

"Therefore & (nent - 1) and % nent are equivalent here"

So please use right engineering thing here and not what AI suggested.

Thanks

> 
> Thanks
> 
> [Li,Rongqing] 
> 
> 
> 
> > 
> > >  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
> > >  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
> > >  		memcpy(dcqe, scqe, dsize);
> > > --
> > > 2.9.4
> > >