)]}'
{
  "commit": "45184d2c87ee2c004b4b9c3fb12e952321d0642f",
  "tree": "1dda4a78ae760d953f8a6f11b0bf75ad8b9e851b",
  "parents": [
    "1c73934b264115f436c8e6944eb5aecf6903ec85"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Sun May 17 10:36:53 2026 +0300"
  },
  "committer": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Mon May 25 17:45:14 2026 +0300"
  },
  "message": "mlx5: Fix inline-scatter source address on 128B CQE REQ completions\n\nIn mlx5_parse_cqe() the inline-scatter completion path used the\nfunction\u0027s void* buffer pointer to address the inline data:\n\n\tif (cqe64-\u003eop_own \u0026 MLX5_INLINE_SCATTER_32)\n\t\terr \u003d mlx5_copy_to_send_wqe(mqp, wqe_ctr, cqe, ...);\n\telse if (cqe64-\u003eop_own \u0026 MLX5_INLINE_SCATTER_64)\n\t\terr \u003d mlx5_copy_to_send_wqe(mqp, wqe_ctr, cqe - 1, ...);\n\n`cqe` is the base of the CQE buffer entry, while `cqe64` points at the\n64B descriptor inside that entry (offset 0 for a 64B entry, offset 64\nfor a 128B entry). Both call sites used the wrong base:\n\n1. SCATTER_64: the payload occupies the first 64B of a 128B\n   entry, so the correct base is `cqe64 - 1`. The existing\n   `cqe - 1` relied on void* pointer arithmetic (a GNU extension\n   that subtracts one byte, not one descriptor) and so was off by\n   63 bytes.\n\n2. SCATTER_32: the inline_32 payload starts at offset 0 of the\n   descriptor, so the correct base is `cqe64`. Passing `cqe`\n   instead reads from offset 0 of the buffer entry, which on a\n   128B CQE is 64 bytes before the payload (the tail of the\n   previous entry). For 64B CQEs cqe \u003d\u003d cqe64 so the bug was\n   masked.\n\nBoth bugs affect inline RDMA_READ / ATOMIC completions on the legacy\nibv_poll_cq path and the extended-CQ ibv_start_poll / ibv_next_poll\npath. The matching responder helpers (handle_responder,\nhandle_responder_lazy, handle_tag_matching) already pass the typed cqe64\npointer and so were not affected.\n\nUse cqe64 / cqe64 - 1 at the REQ-path call sites. The void* cqe\nparameter was only used here, so drop it from mlx5_get_next_cqe(),\nmlx5_parse_cqe(), mlx5_parse_lazy_cqe() and the locals in\nmlx5_poll_one(), mlx5_start_poll() and mlx5_next_poll().\n\nFixes: 8c4791ae2395 (\"libmlx5: First version of libmlx5\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "befacac96e7942a337785ca25b45dc61e7bf41da",
      "old_mode": 33188,
      "old_path": "providers/mlx5/cq.c",
      "new_id": "b2dd66432e2bf678ead2bcc5a62088dc47f96fc8",
      "new_mode": 33188,
      "new_path": "providers/mlx5/cq.c"
    }
  ]
}