From 0fe31052d948a3a993bb2f58cd5886f7ec279ea7 Mon Sep 17 00:00:00 2001 From: Li RongQing Date: Mon, 19 Oct 2026 13:05:03 +0800 Subject: [PATCH] RDMA/mlx5: Fix CQ resize destination index mask In copy_resize_cqes, the destination CQE index is computed as (i + 1) & cq->resize_buf->nent, but resize_buf->nent is produced by roundup_pow_of_two(), so it is a power of two with exactly one bit set. Masking with a single-bit value can only yield 0 or nent itself. The buffer has nent entries, so valid indices are 0 .. nent - 1 and nent is one past the last slot; whenever the masked result is nent the following memcpy writes one entry out of bounds. Use (nent - 1) as the wrap mask instead. For a power-of-two nent, (i + 1) & (nent - 1) is the correct modulo-nent reduction, keeping the index within [0, nent - 1]. This matches get_sw_cqe(), which addresses the CQ buffer via n & cq->ibcq.cqe, where cq->ibcq.cqe == entries - 1 is exactly the nent - 1 wrap mask. Fixes: bde51583f49b ("IB/mlx5: Add support for resize CQ") Signed-off-by: Li RongQing Link: https://patch.msgid.link/20261019050503.2313-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky --- drivers/infiniband/hw/mlx5/cq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c index 7495e20c3dec..55ffd7d4de51 100644 --- a/drivers/infiniband/hw/mlx5/cq.c +++ b/drivers/infiniband/hw/mlx5/cq.c @@ -1316,7 +1316,7 @@ static int copy_resize_cqes(struct mlx5_ib_cq *cq) while (get_cqe_opcode(scqe64) != MLX5_CQE_RESIZE_CQ) { dcqe = mlx5_frag_buf_get_wqe(&cq->resize_buf->fbc, - (i + 1) & cq->resize_buf->nent); + (i + 1) & (cq->resize_buf->nent - 1)); dcqe64 = dsize == 64 ? dcqe : dcqe + 64; sw_own = sw_ownership_bit(i + 1, cq->resize_buf->nent); memcpy(dcqe, scqe, dsize);