Re: [PATCH net] net/mlx5: IPOIB, Fix QPN lookup race

[Dragos Tatulea]

On 30.10.26 01:22, Prathamesh Deshpande wrote:
> mlx5i_pkey_get_netdev() reads the QPN hash table without ht_lock,
> while mlx5i_pkey_del_qpn() removes entries under that lock and then
> frees them.
> 
> PKEY child interfaces share the parent's RX resources, so RX lookups
> can overlap child removal and access a freed entry. A lookup for
> another QPN in the same bucket can also be affected.
>
I don't think that all these cases can happen. But I can see how a
CQE completion on the parent can read a pointer from the hash
bucket that just got deleted.

Please improve the commit message.

> Hold ht_lock during lookup and save node->netdev before unlocking.
> 
Holding the spinlock in the datapath is not a good idea. AFAIU
using hlist RCU variants will be enough.

Thanks,
Dragos