Re: [PATCH for-rc v2] RDMA/efa: Fix race between admin command timeout and completion

[sashiko-bot@kernel.org]

> An admin command that times out can race with the interrupt handler
> processing its completion, in two ways.
> 
> The timeout path releases the completion context without synchronizing
> against the handler. A handler that has already seen the command as
> submitted then copies the CQE into the caller's response buffer after
> the waiter returned and that buffer went out of scope.
> 
> The waiter can also observe the command as completed before the CQE was
> copied, since the status is published first. It decodes its own
> uninitialized response buffer, returns success with garbage contents and
> leaks stack data to the caller. Both wait paths read the status without
> the CQ lock.
> 
> Add a timed-out state and publish it under the CQ lock in both wait
> paths before returning, so the handler, which only completes commands in
> submitted state, cannot act on an abandoned context. In the interrupt
> wait path test the return value of the wait instead of the status: the
> handler signals the completion after copying the CQE, so a successful
> wait implies a valid response. Read the status in the polling wait path
> inside the critical section that drains the CQ, which also lets a
> completion arriving on the last iteration be honored instead of reported
> as a timeout.
> 
> Fixes: 0420e542569b ("RDMA/efa: Implement functions that submit and complete admin commands")
> Reviewed-by: Michael Margolin <mrgolin@amazon.com>
> Reviewed-by: Tom Sela <tomsela@amazon.com>
> Signed-off-by: Yonatan Nachum <ynachum@amazon.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012165113.576899-1-ynachum@amazon.com?part=1