Re: [PATCH for-rc 1/7] RDMA/bnxt_re: Clear stale RCFW resp pointer when wait ends

[sashiko-bot@kernel.org]

> If the wait ends with ERR_DEVICE_DETACHED, bnxt_qplib_map_rc() returns 0
> for destroy-type opcodes, so the caller sees a synthetic success without
> a CREQ. is_waiter_alive and resp are left set, resp keeps pointing at
> the caller's stack, and a late CREQ is copied into a dead frame.
> 
> After the wait, take hwq->lock and, if the slot still holds this
> command's response buffer, clear is_waiter_alive and resp. This also
> covers the timeout case, where it is only defensive since is_waiter_alive
> was already cleared there. Return success without checking evnt->status
> when the slot still holds the buffer, since no completion was processed.
> 
> Also reset the slot in the completion handler, in the same critical
> section that clears is_in_used, so that a second CREQ for the same cookie
> cannot be copied into the caller's buffer. With this, resp == evnt under
> the lock means no completion was processed.
> 
> Clear crsqe->resp when __send_message_no_waiter() takes a slot as well, so
> a stale waiter can never match an internal command's slot by its own
> response buffer pointer.
> 
> Fixes: 3022cc151197 ("RDMA/bnxt_re: Avoid the command wait if firmware is inactive")
> Fixes: 691eb7c6110f ("RDMA/bnxt_re: handle command completions after driver detect a timedout")
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028113404.33289-1-selvin.xavier@broadcom.com?part=1