Re: [PATCH v2 1/2] RDMA/srp: fix use-after-free of a request in srp_destroy_qp()

[Yehyeong Lee]

On 8/18/26 9:26 AM, Bart Van Assche wrote:
> This patch introduces a race condition because it associates a single
> CQE data structure with multiple concurrently submitted work requests.

Thanks for looking at this.

struct ib_cqe holds one member.  After this patch ch->reg_cqe.done and
ch->inv_cqe.done are written only in srp_create_ch_ib(), either before
the first QP exists or after srp_destroy_qp() has drained and destroyed
the previous one, and both writes store the same value every time.
srp_handle_qp_err() finds the channel through cq->cq_context, so neither
handler reads the cqe back.

The sharing is not new: one command posts up to mr_per_cmd REG_MR work
requests, all carrying &req->reg_cqe.  ib_srpt shares ch->zw_cqe the
same way this patch shares ch->reg_cqe.  Could you point at the two work
requests you have in mind?

One thing does get worse: "for CQE %p" in srp_handle_qp_err() used to
differ per request and now takes one of two values per channel.

If a completion has to identify its work request here, I accept that and
will drop patch 1.  Should patch 2 then carry Cc: stable?  Patch 1 is
the one tagged now.

Best regards,

Yehyeong Lee