[PATCH] RDMA/erdma: fix use-after-free in CEQ tasklet teardown

[Fan Wu]

The CEQ interrupt handler schedules a tasklet that accesses the CEQ
buffers. During teardown, erdma_free_ceq_irq() removes the interrupt
handler and waits for any in-flight handler invocation, but does not
wait for a tasklet that was already scheduled by that handler.

erdma_ceq_uninit_one() can then free the EQ qbuf and dbrec while the
tasklet is still accessing them.

Call tasklet_kill() after free_irq(). This prevents new tasklet
scheduling and waits for any already scheduled tasklet before the EQ
buffers are freed.

This issue was found by an in-house static analysis tool.

Fixes: f2a0a630b953 ("RDMA/erdma: Add event queue implementation")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/infiniband/hw/erdma/erdma_eq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index 6486234a2360..78ebec6d48a3 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -219,6 +219,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)

 	irq_set_affinity_hint(eqc->irq.msix_vector, NULL);
 	free_irq(eqc->irq.msix_vector, eqc);
+	tasklet_kill(&dev->ceqs[ceqn].tasklet);
 }

 static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)
--
2.34.1