Re: [PATCH rdma-next] RDMA/irdma: Free cq with a safer cq num reference

[Jacob Moroni]

Reviewed-by: Jacob Moroni <jmoroni@xxxxxxxxxx>

On Fri, Oct 30, 2026 at 1:33 PM David Hu <dhu@xxxxxx> wrote:
>
> From: David Hu <xuehaohu@xxxxxxxxxx>
>
> Within a iwcq, `cq_num` is allocated first, and only
> copied to an inner uk structure, `cq_uk.cq_id` at a
> later stage. Freeing cq by `cq_uk.cq_id` before the
> later stage leads to a cq id leak.
>
> Free `iwcq->cq_num` instead, which is allocated
> right after initial rsrc allocation.
>
> Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
> Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20261016202909.1289496-1-dhu@xxxxxx?part=4
> Signed-off-by: David Hu <xuehaohu@xxxxxxxxxx>
> ---
>  drivers/infiniband/hw/irdma/verbs.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
> index c91c55917de9..1726a0ddeac8 100644
> --- a/drivers/infiniband/hw/irdma/verbs.c
> +++ b/drivers/infiniband/hw/irdma/verbs.c
> @@ -1948,8 +1948,6 @@ static void irdma_srq_free_rsrc(struct irdma_pci_f *rf, struct irdma_srq *iwsrq)
>   */
>  static void irdma_cq_free_rsrc(struct irdma_pci_f *rf, struct irdma_cq *iwcq)
>  {
> -       struct irdma_sc_cq *cq = &iwcq->sc_cq;
> -
>         if (!iwcq->user_mode) {
>                 dma_free_coherent(rf->sc_dev.hw->device, iwcq->kmem.size,
>                                   iwcq->kmem.va, iwcq->kmem.pa);
> @@ -1975,7 +1973,7 @@ static void irdma_cq_free_rsrc(struct irdma_pci_f *rf, struct irdma_cq *iwcq)
>                 }
>         }
>
> -       irdma_free_rsrc(rf, rf->allocated_cqs, cq->cq_uk.cq_id);
> +       irdma_free_rsrc(rf, rf->allocated_cqs, iwcq->cq_num);
>  }
>
>  /**
>
> base-commit: c3e8e9451e6f1b69f685b75e0fbf14f3d0fb2539
> --
> 2.56.0.317.g454f8302e1-goog
>