Re: [PATCH rdma-next] RDMA/mlx5: Free software WCs left on wc_list at CQ destroy

[sashiko-bot@kernel.org]

> Software WCs generated by mlx5_ib_generate_wc() are allocated one at a
> time and linked onto cq->wc_list. The only thing that ever frees them is
> poll_soft_wc(), i.e. a consumer actually reaping them. If the CQ is
> destroyed while entries are still linked, those allocations are leaked.
> 
> Drain the list in destroy_cq_kernel(). Nothing can be walking wc_list by
> then: the poll context is the only walker, notify_work the only thing
> that can re-arm it, and both are stopped before post_destroy_cq() runs.
> 
> destroy_cq_kernel() is also the error unwind for mlx5_ib_create_cq(), so
> move the INIT_LIST_HEAD() of wc_list up next to the other list
> initialisations, ahead of anything that can jump to err_cqb.  The driver
> object is zero-allocated, and list_for_each_entry_safe() evaluates the
> next linkage before testing the loop condition, so draining a wc_list
> that is still all zeroes would oops.
> 
> Fixes: 25361e02c448 ("IB/mlx5: Generate completions in software")
> Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
> Signed-off-by: Edward Srouji <edwards@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103-free-sw-wcs-v1-1-3885ce449012@nvidia.com?part=1