)]}'
{
  "commit": "2dc29c114f5765758cf3695ab3c428e05bb133c7",
  "tree": "774ea44dbb659899e0015ad060f0d2127d617e0c",
  "parents": [
    "d73d3288c5e5aa65b7a8ca5b1593745aedeb5723"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Thu Aug 20 15:20:34 2026 +0300"
  },
  "committer": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Tue Aug 25 11:28:30 2026 +0300"
  },
  "message": "mlx5: Fix signed-overflow UB in __mlx5_cq_clean() sweep condition\n\nThe backward sweep in __mlx5_cq_clean() used:\n\n  while ((int) --prod_index - (int) cq-\u003econs_index \u003e\u003d 0)\n\nBoth operands are uint32_t.  Promoting them to int and then subtracting\nis undefined behaviour when the result overflows (C11 §6.5p5).  GCC and\nClang exploit that UB: they fold \"(int)a - (int)b \u003e\u003d 0\" into the plain\nsigned compare \"(int)a \u003e\u003d (int)b\", which has no exit when cons_index is\n0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.\nEvery other thread polling that CQ blocks; the kernel-side QP is already\ndestroyed, so the process must be killed to recover.  A long-lived process\nsharing one CQ across many short-lived QPs hits this every 2^32\ncompletions (~90 s at 24 M CQE/s, ~10 days at 2.4 k CQE/s).\n\nReplace with a plain unsigned equality check:\n\n  while (prod_index !\u003d cq-\u003econs_index) { --prod_index; ... }\n\nprod_index starts at the value found by the forward scan, which begins\nat cons_index and only increments, so prod_index \u003e\u003d cons_index always\nholds.  Decrementing prod_index each iteration reaches cons_index in\nexactly (prod_index - cons_index) steps.  No arithmetic on the loop\ncondition, no signed casts, no compiler-visible UB.\n\nFixes: 8c4791ae2395 (\"libmlx5: First version of libmlx5\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eeaf4e691ed21ae8a0863ba66ef216bd4f700d6b",
      "old_mode": 33188,
      "old_path": "providers/mlx5/cq.c",
      "new_id": "f892658547e8d8d8c019ced66e18eb3bb31940d6",
      "new_mode": 33188,
      "new_path": "providers/mlx5/cq.c"
    }
  ]
}