)]}'
{
  "commit": "a5e6b11a00d27d5457c49dac02e96f5d84edcc67",
  "tree": "17a3a08281d6777f01b35eede41a0faf29a6029e",
  "parents": [
    "3e6f3bed086bf4db4918072a21c456cca1ca71f8"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Thu Aug 20 15:20:34 2026 +0300"
  },
  "committer": {
    "name": "Nicolas Morey",
    "email": "nmorey@suse.com",
    "time": "Mon Sep 07 19:41:04 2026 +0200"
  },
  "message": "mlx5: Fix signed-overflow UB in __mlx5_cq_clean() sweep condition\n\n[ Upstream commit 2dc29c114f5765758cf3695ab3c428e05bb133c7 ]\n\nThe backward sweep in __mlx5_cq_clean() used:\n\n  while ((int) --prod_index - (int) cq-\u003econs_index \u003e\u003d 0)\n\nBoth operands are uint32_t.  Promoting them to int and then subtracting\nis undefined behaviour when the result overflows (C11 §6.5p5).  GCC and\nClang exploit that UB: they fold \"(int)a - (int)b \u003e\u003d 0\" into the plain\nsigned compare \"(int)a \u003e\u003d (int)b\", which has no exit when cons_index is\n0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.\nEvery other thread polling that CQ blocks; the kernel-side QP is already\ndestroyed, so the process must be killed to recover.  A long-lived process\nsharing one CQ across many short-lived QPs hits this every 2^32\ncompletions (~90 s at 24 M CQE/s, ~10 days at 2.4 k CQE/s).\n\nReplace with a plain unsigned equality check:\n\n  while (prod_index !\u003d cq-\u003econs_index) { --prod_index; ... }\n\nprod_index starts at the value found by the forward scan, which begins\nat cons_index and only increments, so prod_index \u003e\u003d cons_index always\nholds.  Decrementing prod_index each iteration reaches cons_index in\nexactly (prod_index - cons_index) steps.  No arithmetic on the loop\ncondition, no signed casts, no compiler-visible UB.\n\nFixes: 8c4791ae2395 (\"libmlx5: First version of libmlx5\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\nSigned-off-by: Nicolas Morey \u003cnmorey@suse.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2bb2b5875c2bdee5bc9920545bed92b378bd3195",
      "old_mode": 33188,
      "old_path": "providers/mlx5/cq.c",
      "new_id": "f0bd5bee414c5785963f6b639966dec9f3a7f74f",
      "new_mode": 33188,
      "new_path": "providers/mlx5/cq.c"
    }
  ]
}