[PATCH rdma-next v2] RDMA/mlx5: Warn on pending software WCs at CQ destroy

[PATCH rdma-next v2] RDMA/mlx5: Warn on pending software WCs at CQ destroy

[Edward Srouji]

Software WCs generated by mlx5_ib_generate_wc() are allocated, linked
onto cq->wc_list and only freed when a consumer polls them. Anything
still on the list when the CQ is destroyed would be leaked.

This cannot happen with in-tree users. Soft WCs are only generated for
send completions of the mlx5 GSI QP, and ib_mad is the only creator of
GSI QPs. Every MAD send holds a reference on its agent until its send
completion has been processed, unregister_mad_agent() waits for those
references, and ib_mad_port_close() frees the CQ only after all agents
on the port are unregistered. Since poll_soft_wc() frees each soft WC
before its completion handler runs, wc_list is empty by then.

Add a WARN_ON() so that a consumer violating this assumption is caught
instead of silently leaking memory.

Signed-off-by: Edward Srouji <edwards@nvidia.com>
---
Changes in v2:
- Replace freeing of leftover soft WCs with a WARN_ON(), as suggested
  by Leon. wc_list is always empty at CQ destroy with in-tree users,
  see the commit message.
- Drop the Fixes: tag, and Maher's Reviewed-by as the patch was
  rewritten.
- Link to v1: https://lore.kernel.org/r/20261103-free-sw-wcs-v1-1-3885ce449012@nvidia.com
---
 drivers/infiniband/hw/mlx5/cq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 55ffd7d4de517e6ce3f04c98b4edcd94b12e43b3..2581a7693585b2ed57b04b54b8505d3d71ed7238 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -1125,6 +1125,7 @@ int mlx5_ib_pre_destroy_cq(struct ib_cq *cq)
 
 void mlx5_ib_post_destroy_cq(struct ib_cq *cq)
 {
+	WARN_ON(!list_empty(&to_mcq(cq)->wc_list));
 	destroy_cq_kernel(to_mdev(cq->device), to_mcq(cq));
 }
 

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261103-free-sw-wcs-8cf40aa66fd8

Best regards,
-- 
Edward Srouji <edwards@nvidia.com>

Re: [PATCH rdma-next v2] RDMA/mlx5: Warn on pending software WCs at CQ destroy

[sashiko-bot]

> Software WCs generated by mlx5_ib_generate_wc() are allocated, linked
> onto cq->wc_list and only freed when a consumer polls them. Anything
> still on the list when the CQ is destroyed would be leaked.
> 
> This cannot happen with in-tree users. Soft WCs are only generated for
> send completions of the mlx5 GSI QP, and ib_mad is the only creator of
> GSI QPs. Every MAD send holds a reference on its agent until its send
> completion has been processed, unregister_mad_agent() waits for those
> references, and ib_mad_port_close() frees the CQ only after all agents
> on the port are unregistered. Since poll_soft_wc() frees each soft WC
> before its completion handler runs, wc_list is empty by then.
> 
> Add a WARN_ON() so that a consumer violating this assumption is caught
> instead of silently leaking memory.
> 
> Signed-off-by: Edward Srouji <edwards@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-free-sw-wcs-v2-1-d1e6d80d2746@nvidia.com?part=1

Re: [PATCH rdma-next v2] RDMA/mlx5: Warn on pending software WCs at CQ destroy

[Leon Romanovsky]

On Sun, 08 Nov 2026 18:06:12 +0200, Edward Srouji wrote:
> Software WCs generated by mlx5_ib_generate_wc() are allocated, linked
> onto cq->wc_list and only freed when a consumer polls them. Anything
> still on the list when the CQ is destroyed would be leaked.
> 
> This cannot happen with in-tree users. Soft WCs are only generated for
> send completions of the mlx5 GSI QP, and ib_mad is the only creator of
> GSI QPs. Every MAD send holds a reference on its agent until its send
> completion has been processed, unregister_mad_agent() waits for those
> references, and ib_mad_port_close() frees the CQ only after all agents
> on the port are unregistered. Since poll_soft_wc() frees each soft WC
> before its completion handler runs, wc_list is empty by then.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Warn on pending software WCs at CQ destroy
      https://git.kernel.org/rdma/rdma/c/52ace3fd7e1fc1

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>