Re: [PATCH] RDMA/mlx5: Check SIG_ERR CQE mkey lookup before dereferencing

[Leon Romanovsky <leon@kernel.org>]

On Sat, Sep 19, 2026 at 06:08:06PM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> In mlx5_poll_one, a MLX5_CQE_SIG_ERR completion looks up the signature
> context in dev->sig_mrs via xa_load() but dereferences the result without
> a NULL check. If the corresponding MR has been concurrently deregistered

Is this real scenario? Integrity MRs are in-kernel MRs, they shouldn't
be concurrently deregistered.

Thanks

> (which removes the xarray entry without holding the CQ lock), xa_load()
> returns NULL and the subsequent get_sig_err_item(sig_err_cqe, &sig->err_item)
> crashes in atomic context under xa_lock.
> 
> Add a NULL check that drops the lock, logs a warning, and repolls.
> 
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/hw/mlx5/cq.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
> index 49b4bf1..b0b1177 100644
> --- a/drivers/infiniband/hw/mlx5/cq.c
> +++ b/drivers/infiniband/hw/mlx5/cq.c
> @@ -563,6 +563,13 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
>  		xa_lock(&dev->sig_mrs);
>  		sig = xa_load(&dev->sig_mrs,
>  				mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
> +		if (!sig) {
> +			xa_unlock(&dev->sig_mrs);
> +			mlx5_ib_warn(dev, "CQN: 0x%x Got SIGERR on unknown mkey: 0x%x\n",
> +				     cq->mcq.cqn,
> +				     be32_to_cpu(sig_err_cqe->mkey));
> +			goto repoll;
> +		}
>  		get_sig_err_item(sig_err_cqe, &sig->err_item);
>  		sig->sig_err_exists = true;
>  		sig->sigerr_count++;
> -- 
> 2.9.4
>