Hi, Leon
reboot -f skips orderly shutdown and goes directly to:

kernel_restart_prepare() -> device_shutdown() -> mlx5 shutdown
Upper layers may still hold live CQs, while ib-comp-wq keeps
polling — a use-after-free race.

Normal reboot usually works because userspace has already
torn down RDMA and called ib_free_cq().

Thanks

在 2026/7/16 16:42, Leon Romanovsky 写道:

On Wed, Jul 15, 2026 at 04:23:07PM +0800, Chenguang Zhao wrote:

quoted

From: Chenguang Zhao <redacted>

On reboot -f with NFS over RDMA, mlx5 shutdown can tear the device
down while ib-comp-wq still polls live CQs, leading to UAF in
wr_cqe->done().

Mark the device shutting down before teardown, flush completion
workqueues so in-flight pollers observe the flag, skip SYS_ERROR
completion delivery, and make poll/arm CQ a no-op under the CQ lock
while shutting down.

Signed-off-by: Chenguang Zhao <redacted>
---
changelog:
 - Fix the race on MLX5_INTERFACE_STATE_SHUTTING_DOWN: set the
   flag, then flush ib-comp / mlx5_ib event workqueues via an
   mlx5_ib quiesce hook before fast_unload/teardown.
 - Check shutting-down under cq->lock in mlx5_ib_poll_cq/arm_cq.
 - Export ib_comp_wq and ib_comp_unbound_wq so modular mlx5_ib
   can flush them.

v2:
 https://lore.kernel.org/all/20260714075558.1420384-1-chenguang.zhao@linux.dev/ (local)

v1:
 https://lore.kernel.org/all/20260702073422.279820-1-chenguang.zhao@linux.dev/ (local)

 drivers/infiniband/core/device.c              |  2 ++
 drivers/infiniband/hw/mlx5/cq.c               | 11 ++++++++++
 drivers/infiniband/hw/mlx5/main.c             | 20 +++++++++++++++++++
 .../net/ethernet/mellanox/mlx5/core/health.c  |  3 +++
 .../net/ethernet/mellanox/mlx5/core/main.c    | 10 ++++++++++
 .../mellanox/mlx5/core/sf/dev/driver.c        |  3 +++
 include/linux/mlx5/driver.h                   | 11 ++++++++++
 7 files changed, 60 insertions(+)

<...>

quoted

+static void mlx5_ib_shutdown_quiesce(void)
+{
+	flush_workqueue(ib_comp_wq);
+	flush_workqueue(ib_comp_unbound_wq);
+	flush_workqueue(mlx5_ib_event_wq);
+}

These workqueues are shared by all IB drivers and the core. Drivers
must not flush or destroy them.

Why this is not FW issue?

Thanks