[PATCH rdma-next v2] RDMA/mlx5: Warn on pending software WCs at CQ destroy

[Edward Srouji]

Software WCs generated by mlx5_ib_generate_wc() are allocated, linked
onto cq->wc_list and only freed when a consumer polls them. Anything
still on the list when the CQ is destroyed would be leaked.

This cannot happen with in-tree users. Soft WCs are only generated for
send completions of the mlx5 GSI QP, and ib_mad is the only creator of
GSI QPs. Every MAD send holds a reference on its agent until its send
completion has been processed, unregister_mad_agent() waits for those
references, and ib_mad_port_close() frees the CQ only after all agents
on the port are unregistered. Since poll_soft_wc() frees each soft WC
before its completion handler runs, wc_list is empty by then.

Add a WARN_ON() so that a consumer violating this assumption is caught
instead of silently leaking memory.

Signed-off-by: Edward Srouji <edwards@xxxxxxxxxx>
---
Changes in v2:
- Replace freeing of leftover soft WCs with a WARN_ON(), as suggested
  by Leon. wc_list is always empty at CQ destroy with in-tree users,
  see the commit message.
- Drop the Fixes: tag, and Maher's Reviewed-by as the patch was
  rewritten.
- Link to v1: https://lore.kernel.org/r/20261103-free-sw-wcs-v1-1-3885ce449012@xxxxxxxxxx
---
 drivers/infiniband/hw/mlx5/cq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 55ffd7d4de517e6ce3f04c98b4edcd94b12e43b3..2581a7693585b2ed57b04b54b8505d3d71ed7238 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -1125,6 +1125,7 @@ int mlx5_ib_pre_destroy_cq(struct ib_cq *cq)
 
 void mlx5_ib_post_destroy_cq(struct ib_cq *cq)
 {
+	WARN_ON(!list_empty(&to_mcq(cq)->wc_list));
 	destroy_cq_kernel(to_mdev(cq->device), to_mcq(cq));
 }
 

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261103-free-sw-wcs-8cf40aa66fd8

Best regards,
-- 
Edward Srouji <edwards@xxxxxxxxxx>