)]}'
{
  "commit": "b5acfb93ee5a6d9fd52c3fcdfa98325afd8a8059",
  "tree": "cafc3ca39167ba8f1310f1c39bb7727b1f8cd424",
  "parents": [
    "4c28ae389c4ebc2171f4aaee21946176cbe40d38"
  ],
  "author": {
    "name": "Yishai Hadas",
    "email": "yishaih@nvidia.com",
    "time": "Tue Aug 25 09:58:28 2026 +0300"
  },
  "committer": {
    "name": "Nicolas Morey",
    "email": "nmorey@suse.com",
    "time": "Mon Sep 07 19:40:46 2026 +0200"
  },
  "message": "mlx4: Fix signed-overflow UB in mlx4_cq_clean() sweep condition\n\n[ Upstream commit 9d43cfc0896433e28a3a3ac713aa7c465c8df93c ]\n\nThe backward sweep in mlx4_cq_clean() used:\n\n  while ((int) --prod_index - (int) cq-\u003econs_index \u003e\u003d 0)\n\nBoth operands are uint32_t.  Promoting them to int and then subtracting\nis undefined behaviour when the result overflows (C11 §6.5p5).  GCC and\nClang exploit that UB: they fold \"(int)a - (int)b \u003e\u003d 0\" into the plain\nsigned compare \"(int)a \u003e\u003d (int)b\", which has no exit when cons_index is\n0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.\n\nReplace with a plain unsigned equality check — identical fix to the one\napplied to providers/mlx5/cq.c:\n\n  while (prod_index !\u003d cq-\u003econs_index) { --prod_index; ... }\n\nprod_index starts at the value found by the forward scan, which begins\nat cons_index and only increments, so prod_index \u003e\u003d cons_index always\nholds.  Decrementing prod_index each iteration reaches cons_index in\nexactly (prod_index - cons_index) steps.  No arithmetic on the loop\ncondition, no signed casts, no compiler-visible UB.\n\nFixes: 3e44e8d14a32 (\"Implement mlx4_cq_clean()\")\nSigned-off-by: Yishai Hadas \u003cyishaih@nvidia.com\u003e\nSigned-off-by: Nicolas Morey \u003cnmorey@suse.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "61313b8f69b9ccd3d9016551bc5d8577c90882d0",
      "old_mode": 33188,
      "old_path": "providers/mlx4/cq.c",
      "new_id": "e17ae2204030b5f0505604f5baa6a6647fd55f38",
      "new_mode": 33188,
      "new_path": "providers/mlx4/cq.c"
    }
  ]
}