Re: [PATCH] RDMA/erdma: Fix CEQ tasklet use-after-free on removal

[Leon Romanovsky]

On Tue, 21 Jul 2026 17:25:45 +0900, Myeonghun Pak wrote:
> Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
> erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring
> through get_next_valid_eqe() and updates eq->dbrec through notify_eq().
> 
> erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ.
> free_irq() prevents another hard IRQ and waits for an in-flight handler,
> but it does not drain a tasklet that the handler already scheduled. The
> tasklet can therefore access eq->qbuf or eq->dbrec after
> erdma_eq_destroy() frees them.
> 
> [...]

Applied, thanks!

[1/1] RDMA/erdma: Fix CEQ tasklet use-after-free on removal
      https://git.kernel.org/rdma/rdma/c/0ca79979384f03

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>