On Wed, Jul 22, 2026 at 09:18:12AM +0000, Konstantin Taranov wrote: > > From: Leon Romanovsky <[email protected]> > > > > mana_table_store_ud_qp() publishes a QP at its send-queue id before > > inserting the receive-queue id, dropping the XArray lock between the two > > xa_insert_irq() calls. A concurrent completion handler can look up the QP > > and > > take a transient reference. When the second insertion fails, the rollback > > erased only the send-queue entry and returned, leaving both the initial > > table > > reference and the transient reference outstanding while RDMA core frees the > > QP, causing a use-after-free. > > > > Drain the reference as normal destruction does: drop the initial reference > > and > > wait for qp->free, releasing the QP only after every concurrent lookup > > returns > > its reference. > > > > Fixes: 8001e9257eca ("RDMA/mana_ib: extend mana QP table") > > Signed-off-by: Leon Romanovsky <[email protected]> > > Reviewed-by: Konstantin Taranov <[email protected]> > > > --- > > Konstantin, > > > > I saw this in one of the Sashiko runs, and I believe the AI is correct. The > > reference can be acquired through the GDMA_EQE_RNIC_QP_FATAL event. > > > > I doubt that it is possible for EQEs. The eqe only can mention an RQ and we > first try to insert an SQ. > As well as when we drain GSI QP, we also look up with an RQ.
GDMA_EQE_RNIC_QP_FATAL is my interpretation, and not AI :). Thanks
