Re: [PATCH v2 1/2] RDMA/srp: fix use-after-free of a request in srp_destroy_qp()
Bart Van Assche <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On 8/17/26 8:52 PM, Yehyeong Lee wrote:
> -static int srp_inv_rkey(struct srp_request *req, struct srp_rdma_ch *ch,
> - u32 rkey)
> +static int srp_inv_rkey(struct srp_rdma_ch *ch, u32 rkey)
> {
> struct ib_send_wr wr = {
> .opcode = IB_WR_LOCAL_INV,
> @@ -1170,8 +1173,7 @@ static int srp_inv_rkey(struct srp_request *req, struct srp_rdma_ch *ch,
> .ex.invalidate_rkey = rkey,
> };
>
> - wr.wr_cqe = &req->reg_cqe;
> - req->reg_cqe.done = srp_inv_rkey_err_done;
> + wr.wr_cqe = &ch->inv_cqe;
> return ib_post_send(ch->qp, &wr, NULL);
> }
This patch introduces a race condition because it associates a single
CQE data structure with multiple concurrently submitted work requests.
Please drop this patch.
Thanks,
Bart.