Re: 答复: [????] Re: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask

[Leon Romanovsky <leon@kernel.org>]

On Tue, Sep 29, 2026 at 01:06:18AM +0000, Li,Rongqing wrote:
> > On Sat, Sep 19, 2026 at 06:07:16PM +0800, lirongqing wrote:
> > > From: Li RongQing <lirongqing@baidu.com>
> > >
> > > In copy_resize_cqes, the destination CQE index is computed as (i + 1)
> > > & cq->resize_buf->nent, but resize_buf->nent is the power-of-two entry
> > > count, so the mask only yields 0 or nent -- and nent is one past the
> > > last valid slot. The following memcpy then writes out of bounds.
> > >
> > > Use (nent - 1) as the wrap mask, consistent with get_sw_cqe which
> > > masks against cq->ibcq.cqe (the nent - 1 value).
> > >
> > > Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ")
> > > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > > ---
> > >  drivers/infiniband/hw/mlx5/cq.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/infiniband/hw/mlx5/cq.c
> > > b/drivers/infiniband/hw/mlx5/cq.c index b0b1177..5bd5227 100644
> > > --- a/drivers/infiniband/hw/mlx5/cq.c
> > > +++ b/drivers/infiniband/hw/mlx5/cq.c
> > > @@ -1319,7 +1319,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq
> > > *cq)
> > >
> > >  	while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) {
> > >  		dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc,
> > > -					     (i + 1) & cq->resize_buf->nent);
> > > +					     (i + 1) & (cq->resize_buf->nent - 1));
> > 
> > I think the original intent was to use `(i + 1) % cq->resize_buf->nent`.
> > 
> > Thanks
> 
> resize_buf->nent is guaranteed to be a power of two by roundup_pow_of_two(entries + 1), 
> and sw_ownership_bit()/get_sw_cqe() in the same path both rely on this invariant.
> Therefore & (nent - 1) and % nent are equivalent here; the bitwise form is kept for consistency
> with the surrounding code.

"Therefore & (nent - 1) and % nent are equivalent here"

So please use right engineering thing here and not what AI suggested.

Thanks

> 
> Thanks
> 
> [Li,Rongqing] 
> 
> 
> 
> > 
> > >  		dcqe64 = dsize == 64 ? dcqe : dcqe + 64;
> > >  		sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent);
> > >  		memcpy(dcqe, scqe, dsize);
> > > --
> > > 2.9.4
> > >