Re: [PATCH] RDMA/erdma: Fix CEQ tasklet use-after-free on removal

[Cheng Xu]

On 7/21/26 9:24 PM, Jacob Moroni wrote:
> Hi,
> 
> I was looking at this driver and was curious if you also need
> some type of synchronization after the xa_erase in erdma_destroy_cq.
> 
> Otherwise, it seems like the CEQ tasklet could do the xa_load right
> before erdma_destroy_cq does the xa_erase, then destroy_cq proceeds
> to return and kfree the CQ while the tasket is in the middle of comp_handler.
> 
> Most drivers either do a synchronize_irq (which I don't think would work for
> this since it's a tasklet) or some form of locked refcounting when
> accessing the xarray.
> 

Hi Jacob,

Thanks for pointing this out.

For kernel CQs this should be unlikely in practice, since the associated
QPs are destroyed first and the kernel QP destroy path drains the WQEs
before the CQ is destroyed.

However, the user CQ path does not have the same guarantee, so the race
you described still needs to be handled. We need to add synchronization
in the CQ destroy path, and I will take a closer look at this.

Thanks,
Cheng Xu

> Thanks,
> Jake