Re: [PATCH v2 1/2] RDMA/srp: fix use-after-free of a request in srp_destroy_qp()

[Bart Van Assche]

On 8/17/26 8:52 PM, Yehyeong Lee wrote:
> -static int srp_inv_rkey(struct srp_request *req, struct srp_rdma_ch *ch,
> -		u32 rkey)
> +static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
>   {
>   	struct ib_send_wr wr = {
>   		.opcode		    = IB_WR_LOCAL_INV,
> @@ -1170,8 +1173,7 @@ static int srp_inv_rkey(struct srp_request *req, struct srp_rdma_ch *ch,
>   		.ex.invalidate_rkey = rkey,
>   	};
>   
> -	wr.wr_cqe = &req->reg_cqe;
> -	req->reg_cqe.done = srp_inv_rkey_err_done;
> +	wr.wr_cqe = &ch->inv_cqe;
>   	return ib_post_send(ch->qp, &wr, NULL);
>   }

This patch introduces a race condition because it associates a single
CQE data structure with multiple concurrently submitted work requests.
Please drop this patch.

Thanks,

Bart.