Re: [PATCH] RDMA/erdma: Fix CEQ tasklet use-after-free on removal

[Jacob Moroni]

Hi,

I was looking at this driver and was curious if you also need
some type of synchronization after the xa_erase in erdma_destroy_cq.

Otherwise, it seems like the CEQ tasklet could do the xa_load right
before erdma_destroy_cq does the xa_erase, then destroy_cq proceeds
to return and kfree the CQ while the tasket is in the middle of comp_handler.

Most drivers either do a synchronize_irq (which I don't think would work for
this since it's a tasklet) or some form of locked refcounting when
accessing the xarray.

Thanks,
Jake