Re: [PATCH] RDMA/srp: fix use-after-free of a request in srp_destroy_qp()

[Yehyeong Lee]

On 8/13/26 5:30 AM, Bart Van Assche wrote:
> This change can cause ch->reg_cqe and ch->inv_cqe to be overwritten
> before the previously submitted work has completed, isn't it? Isn't that
> a bug?

struct ib_cqe holds one member, the done pointer, and this patch writes
ch->reg_cqe.done and ch->inv_cqe.done once each, in srp_create_ch_ib().
srp_map_finish_fr() and srp_inv_rkey() only take the address, so nothing
is written while a work request is outstanding.

The current code is the one that assigns per work request, and it stores
both srp_reg_mr_err_done and srp_inv_rkey_err_done into the same
req->reg_cqe, so a REG_MR still outstanding when the rkey is invalidated
is reported as INV RKEY.

Sharing a CQE is safe here because neither handler reads it: both pass it
to srp_handle_qp_err(), which takes the channel from cq->cq_context.

Best regards,

Yehyeong Lee