Re: [PATCH] RDMA/erdma: Fix CEQ tasklet use-after-free on removal

[Cheng Xu]

On 7/21/26 4:25 PM, Myeonghun Pak wrote:
> Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
> erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring
> through get_next_valid_eqe() and updates eq->dbrec through notify_eq().
> 
> erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ.
> free_irq() prevents another hard IRQ and waits for an in-flight handler,
> but it does not drain a tasklet that the handler already scheduled. The
> tasklet can therefore access eq->qbuf or eq->dbrec after
> erdma_eq_destroy() frees them.
> 
> Clearing ceq_cb->ready does not synchronize with a tasklet that already
> passed the check at the start of erdma_ceq_completion_handler().
> 
> Kill the tasklet after free_irq(), when no handler can schedule it again,
> and before erdma_ceq_uninit_one() releases the EQ buffers.
> 
> Fixes: f2a0a630b953 ("RDMA/erdma: Add event queue implementation")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
> ---
> Found by static analysis only; not tested on ERDMA hardware. Testing on
> hardware, particularly device removal while CEQ interrupts are active,
> would be appreciated.
> 
>  drivers/infiniband/hw/erdma/erdma_eq.c | 1 +
>  1 file changed, 1 insertion(+)
> 

Acked-by: Cheng Xu <chengyou@xxxxxxxxxxxxxxxxx>

Thanks.

While this is unlikely to happen in practice, since the ibdev has already
been removed and no CQs should remain to generate CEQ events, this patch
makes the CEQ teardown ordering explicit and robust.

Cheng Xu


> diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
> index d5b9d19882b2..a8784e07acd6 100644
> --- a/drivers/infiniband/hw/erdma/erdma_eq.c
> +++ b/drivers/infiniband/hw/erdma/erdma_eq.c
> @@ -220,6 +220,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)
>  
>  	irq_set_affinity_hint(eqc->irq.msix_vector, NULL);
>  	free_irq(eqc->irq.msix_vector, eqc);
> +	tasklet_kill(&eqc->tasklet);
>  }
>  
>  static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)