From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B51BF306B11; Tue, 12 May 2026 18:12:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778609548; cv=none; b=topUK3Dze0cPjTiJCL8zMrlFcvOmy+5vIdtEInGruzxns1nuOBLSvYaza+/JfXQj7aAY+3/BfATOm1Jly3/uhuRh78PyxsjRt4xSBGeFACt9AIBIQlOdBqju918NImqyYsAtk3q5jFWWEK3kAK3uimEih9Z8BNhWZJ2WUcvfIck= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778609548; c=relaxed/simple; bh=arm+N3/w5O8t+YQbKMFakkpFICRzpx7BJz9VIPuGZzA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UkKcWBs4U8xVT3g3czzlx2SfVZ+iJ1ecKHGp9JMYtIza9D4q76QkdbFLiez8HCRMAXwF02Uqg/2h5uzb2Yy+sFw0BIbFKBXVyCwIyLQG5yQkfNbvrVbTfmSf/OET+sWfxkJh0Z5LIvFuS/wtpJozGjKMuqFkNHzCGTPtEVx7/qo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zOPEzM1l; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zOPEzM1l" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08B8AC2BCB0; Tue, 12 May 2026 18:12:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778609548; bh=arm+N3/w5O8t+YQbKMFakkpFICRzpx7BJz9VIPuGZzA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zOPEzM1ldrdW2CkkQmth6WmWbOMvqfR/r2CjfM2OX0FD5svLPHYZh+mQbvEz1IVV2 yhVGjcOtOlvO6pQ6iDYxwEKaF+Ql+iBKl+UQLQgSqrEOo+gQQgGGKnENJcAaRLPTOl gNhY9d1HuKCwt3n64IQuakjv//7UjjKumr175HWg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jason Gunthorpe Subject: [PATCH 7.0 237/307] RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Date: Tue, 12 May 2026 19:40:32 +0200 Message-ID: <20260512173945.123460675@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260512173940.117428952@linuxfoundation.org> References: <20260512173940.117428952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jason Gunthorpe commit c9341307ea16b9395c2e4c9c94d8499d91fe31d0 upstream. Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical section. It also will crash if an event is delivered before the srq object is finished initializing. Use the spinlock since it isn't easy to make RCU work, use refcount_inc_not_zero() to protect against partially initialized objects, and order the refcount_set() to be after the srq is fully initialized. Cc: stable@vger.kernel.org Fixes: 30353bfc43a1 ("net/mlx4_core: Use RCU to perform radix tree lookup for SRQ") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=5 Link: https://patch.msgid.link/r/12-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx4/srq.c +++ b/drivers/net/ethernet/mellanox/mlx4/srq.c @@ -44,13 +44,14 @@ void mlx4_srq_event(struct mlx4_dev *dev { struct mlx4_srq_table *srq_table = &mlx4_priv(dev)->srq_table; struct mlx4_srq *srq; + unsigned long flags; - rcu_read_lock(); + spin_lock_irqsave(&srq_table->lock, flags); srq = radix_tree_lookup(&srq_table->tree, srqn & (dev->caps.num_srqs - 1)); - rcu_read_unlock(); - if (srq) - refcount_inc(&srq->refcount); - else { + if (!srq || !refcount_inc_not_zero(&srq->refcount)) + srq = NULL; + spin_unlock_irqrestore(&srq_table->lock, flags); + if (!srq) { mlx4_warn(dev, "Async event for bogus SRQ %08x\n", srqn); return; } @@ -203,8 +204,8 @@ int mlx4_srq_alloc(struct mlx4_dev *dev, if (err) goto err_radix; - refcount_set(&srq->refcount, 1); init_completion(&srq->free); + refcount_set_release(&srq->refcount, 1); return 0;