Re: [PATCH rdma-next v3] RDMA/mlx5: quiesce CQ polling before device shutdown on reboot

On Thu, Jul 16, 2026 at 01:50:08PM +0300, Leon Romanovsky wrote:
> On Thu, Jul 16, 2026 at 05:03:37PM +0800, Chenguang Zhao wrote:
> > Hi, Leon
> > reboot -f skips orderly shutdown and goes directly to:
> > 
> > kernel_restart_prepare() -> device_shutdown() -> mlx5 shutdown
> > Upper layers may still hold live CQs, while ib-comp-wq keeps
> > polling — a use-after-free race.
> 
> The point is that this flow is neither RDMA- nor mlx5-specific, and it
> works as expected. mlx5 shutdown() stops the FW/HW, while the kernel
> stops and tears down the running threads.

I'm pretty sure we are missing stuff in the driver to synchronize
everything while it is doing a tear down or health recovery.

Ripping a driver out from under a still-running subsystem is hard,
this does seem like a real bug, but I also don't think the shutdown
handler is the right place to fix it..

What was the actual UAF scenario, we should take a look at that more
directly?

Jason