[PATCH rdma-next] RDMA/irdma: Free cq with a safer cq num reference

[David Hu]

From: David Hu <xuehaohu@xxxxxxxxxx>

Within a iwcq, `cq_num` is allocated first, and only
copied to an inner uk structure, `cq_uk.cq_id` at a
later stage. Freeing cq by `cq_uk.cq_id` before the
later stage leads to a cq id leak.

Free `iwcq->cq_num` instead, which is allocated
right after initial rsrc allocation.

Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/patchset/20261016202909.1289496-1-dhu@xxxxxx?part=4
Signed-off-by: David Hu <xuehaohu@xxxxxxxxxx>
---
 drivers/infiniband/hw/irdma/verbs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c91c55917de9..1726a0ddeac8 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -1948,8 +1948,6 @@ static void irdma_srq_free_rsrc(struct irdma_pci_f *rf, struct irdma_srq *iwsrq)
  */
 static void irdma_cq_free_rsrc(struct irdma_pci_f *rf, struct irdma_cq *iwcq)
 {
-	struct irdma_sc_cq *cq = &iwcq->sc_cq;
-
 	if (!iwcq->user_mode) {
 		dma_free_coherent(rf->sc_dev.hw->device, iwcq->kmem.size,
 				  iwcq->kmem.va, iwcq->kmem.pa);
@@ -1975,7 +1973,7 @@ static void irdma_cq_free_rsrc(struct irdma_pci_f *rf, struct irdma_cq *iwcq)
 		}
 	}
 
-	irdma_free_rsrc(rf, rf->allocated_cqs, cq->cq_uk.cq_id);
+	irdma_free_rsrc(rf, rf->allocated_cqs, iwcq->cq_num);
 }
 
 /**

base-commit: c3e8e9451e6f1b69f685b75e0fbf14f3d0fb2539
-- 
2.56.0.317.g454f8302e1-goog