)]}'
{
  "commit": "1c6707ecd6a0bc2cd8f76b167ce1351a252cd7be",
  "tree": "2e44636e67d6ef75dccc054c9ad9ed5dfb9cf2f6",
  "parents": [
    "bed93a157328bc5d844705683705f96da096fc8a"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Tue Aug 25 09:58:28 2026 +0300"
  },
  "committer": {
    "name": "Nicolas Morey",
    "email": "nmorey@suse.com",
    "time": "Mon Sep 07 19:40:50 2026 +0200"
  },
  "message": "mlx4: Fix signed-overflow UB in mlx4_cq_clean() sweep condition\n\n[ Upstream commit 9d43cfc0896433e28a3a3ac713aa7c465c8df93c ]\n\nThe backward sweep in mlx4_cq_clean() used:\n\n  while ((int) --prod_index - (int) cq-\u003econs_index \u003e\u003d 0)\n\nBoth operands are uint32_t.  Promoting them to int and then subtracting\nis undefined behaviour when the result overflows (C11 §6.5p5).  GCC and\nClang exploit that UB: they fold \"(int)a - (int)b \u003e\u003d 0\" into the plain\nsigned compare \"(int)a \u003e\u003d (int)b\", which has no exit when cons_index is\n0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.\n\nReplace with a plain unsigned equality check — identical fix to the one\napplied to providers/mlx5/cq.c:\n\n  while (prod_index !\u003d cq-\u003econs_index) { --prod_index; ... }\n\nprod_index starts at the value found by the forward scan, which begins\nat cons_index and only increments, so prod_index \u003e\u003d cons_index always\nholds.  Decrementing prod_index each iteration reaches cons_index in\nexactly (prod_index - cons_index) steps.  No arithmetic on the loop\ncondition, no signed casts, no compiler-visible UB.\n\nFixes: 3e44e8d14a32 (\"Implement mlx4_cq_clean()\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\nSigned-off-by: Nicolas Morey \u003cnmorey@suse.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "61313b8f69b9ccd3d9016551bc5d8577c90882d0",
      "old_mode": 33188,
      "old_path": "providers/mlx4/cq.c",
      "new_id": "e17ae2204030b5f0505604f5baa6a6647fd55f38",
      "new_mode": 33188,
      "new_path": "providers/mlx4/cq.c"
    }
  ]
}