On Tue, 21 Jul 2026 18:00:01 +0300, Leon Romanovsky wrote:
> mana_table_store_ud_qp() publishes a QP at its send-queue id before
> inserting the receive-queue id, dropping the XArray lock between the two
> xa_insert_irq() calls. A concurrent completion handler can look up the QP
> and take a transient reference. When the second insertion fails, the
> rollback erased only the send-queue entry and returned, leaving both the
> initial table reference and the transient reference outstanding while RDMA
> core frees the QP, causing a use-after-free.
>
> [...]
Applied, thanks!
[1/1] RDMA/mana_ib: drain QP references after partial table insertion
https://git.kernel.org/rdma/rdma/c/97f7c2262c28eb
Best regards,
--
Leon Romanovsky <[email protected]>
