)]}'
{
  "commit": "8c9883ce79bbb362f3f7a282002c0337335f7699",
  "tree": "19401e79804d8357e7fcdbf739f40b05d7733e28",
  "parents": [
    "0a3eb1b97c403327ecb71d7d766b6f695f0c7517"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Tue Aug 25 09:58:48 2026 +0300"
  },
  "committer": {
    "name": "Nicolas Morey",
    "email": "nmorey@suse.com",
    "time": "Mon Sep 07 19:43:47 2026 +0200"
  },
  "message": "mthca: Fix signed-overflow UB in __mthca_cq_clean() sweep condition\n\n[ Upstream commit 8bc76f2d55c703201649c985ac31cfb828c916c6 ]\n\nThe backward sweep in __mthca_cq_clean() used:\n\n  while ((int) --prod_index - (int) cq-\u003econs_index \u003e\u003d 0)\n\nBoth operands are uint32_t.  Promoting them to int and then subtracting\nis undefined behaviour when the result overflows (C11 §6.5p5).  GCC and\nClang exploit that UB: they fold \"(int)a - (int)b \u003e\u003d 0\" into the plain\nsigned compare \"(int)a \u003e\u003d (int)b\", which has no exit when cons_index is\n0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.\n\nReplace with a plain unsigned equality check — identical fix to the one\napplied to providers/mlx5/cq.c and providers/mlx4/cq.c:\n\n  while (prod_index !\u003d cq-\u003econs_index) { --prod_index; ... }\n\nprod_index starts at the value found by the forward scan, which begins\nat cons_index and only increments, so prod_index \u003e\u003d cons_index always\nholds.  Decrementing prod_index each iteration reaches cons_index in\nexactly (prod_index - cons_index) steps.  No arithmetic on the loop\ncondition, no signed casts, no compiler-visible UB.\n\nFixes: f0721148654c (\"Fix long request lists for Tavor HCAs\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\nSigned-off-by: Nicolas Morey \u003cnmorey@suse.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dd8baca198c3a3da7786220c8f4b4ab7491d0cf2",
      "old_mode": 33188,
      "old_path": "providers/mthca/cq.c",
      "new_id": "3fff17f8dcfd0899f994a7b76da920ff43d408ea",
      "new_mode": 33188,
      "new_path": "providers/mthca/cq.c"
    }
  ]
}