Re: [PATCH] RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

[Jason Gunthorpe <jgg@nvidia.com>]

On Fri, Apr 24, 2026 at 01:51:02PM +0800, Junrui Luo wrote:
> mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When
> ib_create_srq() fails for s1, the error branch destroys s0 but falls
> through and unconditionally assigns the freed s0 and the ERR_PTR s1
> to devr->s0 and devr->s1.
> 
> This leads to several problems: the lock-free fast path checks
> "if (devr->s1) return 0;" and treats the ERR_PTR as already
> initialised; users in mlx5_ib_create_qp() dereference the freed SRQ or
> ERR_PTR via to_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup()
> dereferences the ERR_PTR and double-frees s0 on teardown.
> 
> Fix by adding the same `goto unlock` in the s1 failure path.
> 
> Fixes: 5895e70f2e6e ("IB/mlx5: Allocate resources just before first QP/SRQ is created")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  drivers/infiniband/hw/mlx5/main.c | 1 +
>  1 file changed, 1 insertion(+)

Applied to for rc

Thanks,
Jason