Re: [PATCH for-rc] RDMA/efa: Fix race between admin command timeout and completion

[Gal Pressman <gal.pressman@linux.dev>]

On 01/09/2026 14:30, Yonatan Nachum wrote:
> When an admin command times out, there is a potential race between the
> interrupt handler processing the completion and the timeout path
> releasing the completion context. The interrupt handler may observe the
> command as still submitted and attempt to complete it while the timeout
> path is concurrently freeing the context.
> 
> Fix this by introducing a timed-out state in the completion context. On
> timeout, both the polling and interrupt wait paths set the status to
> timed-out under the CQ lock before returning. The completion handler
> only process commands in submitted state, eliminating the race.
> 
> Fixes: 0420e542569b ("RDMA/efa: Implement functions that submit and complete admin commands")
> Reviewed-by: Tom Sela <tomsela@amazon.com>
> Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
> ---
>  drivers/infiniband/hw/efa/efa_com.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/efa/efa_com.c b/drivers/infiniband/hw/efa/efa_com.c
> index 583b1cf0d721..a91de9283b6b 100644
> --- a/drivers/infiniband/hw/efa/efa_com.c
> +++ b/drivers/infiniband/hw/efa/efa_com.c
> @@ -41,6 +41,7 @@ enum efa_cmd_status {
>  	EFA_CMD_ALLOCATED,
>  	EFA_CMD_SUBMITTED,
>  	EFA_CMD_COMPLETED,
> +	EFA_CMD_TIMED_OUT,
>  };
>  
>  struct efa_comp_ctx {
> @@ -605,6 +606,10 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_c
>  			break;
>  
>  		if (time_is_before_jiffies(timeout)) {
> +			spin_lock_irqsave(&aq->cq.lock, flags);
> +			comp_ctx->status = EFA_CMD_TIMED_OUT;
> +			spin_unlock_irqrestore(&aq->cq.lock, flags);

This smells bad, a few lines above 'comp_ctx->status' is being read
without a lock. Can't it change during this window?