irdma_cfg_ceq_vector() registers an IRQ handler before requesting the
CEQ-to-vector mapping through the virtual channel. If the mapping
fails, the function returns without releasing the IRQ resources.
The caller destroys the CEQ, leaving the IRQ handler registered
and potentially referencing freed memory.

Call irdma_destroy_irq() on mapping failure to release
the IRQ resources and drain the associated tasklet
before the caller destroys the CEQ. Use the same dev_id
passed to request_irq(), accounting for CEQ0 sharing
its interrupt vector with the AEQ.

Fixes: b800e82feba7 ("RDMA/irdma: Add GEN3 support for AEQ and CEQ")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Assisted-by: Claude:claude-opus-5
---
Found by smatch:
.../drivers/infiniband/hw/irdma/hw.c:1261 irdma_cfg_ceq_vector() warn: 'msix_vec->irq' from request_irq() not released on lines: 1261.

I performed only compilation test, it hasn't been tested on hardware. 

 drivers/infiniband/hw/irdma/hw.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
index cae4f316def4..522a1685d400 100644
--- a/drivers/infiniband/hw/irdma/hw.c
+++ b/drivers/infiniband/hw/irdma/hw.c
@@ -1252,12 +1252,20 @@ static int irdma_cfg_ceq_vector(struct irdma_pci_f *rf, struct irdma_ceq *iwceq,
 	}
 
 	msix_vec->ceq_id = ceq_id;
-	if (rf->sc_dev.privileged)
+	if (rf->sc_dev.privileged) {
 		rf->sc_dev.irq_ops->irdma_cfg_ceq(&rf->sc_dev, ceq_id,
 						  msix_vec->idx, true);
-	else
+	} else {
 		status = irdma_vchnl_req_ceq_vec_map(&rf->sc_dev, ceq_id,
 						     msix_vec->idx);
+		if (status) {
+			void *dev_id = (rf->msix_shared && !ceq_id) ?
+				(void *)rf : (void *)iwceq;
+
+			irdma_destroy_irq(rf, msix_vec, dev_id);
+		}
+	}
+
 	return status;
 }
 
-- 
2.53.0

On Fri, 18 Sep 2026 14:04:28 +0300, Serhat Kumral wrote:
> irdma_cfg_ceq_vector() registers an IRQ handler before requesting the
> CEQ-to-vector mapping through the virtual channel. If the mapping
> fails, the function returns without releasing the IRQ resources.
> The caller destroys the CEQ, leaving the IRQ handler registered
> and potentially referencing freed memory.
> 
> Call irdma_destroy_irq() on mapping failure to release
> the IRQ resources and drain the associated tasklet
> before the caller destroys the CEQ. Use the same dev_id
> passed to request_irq(), accounting for CEQ0 sharing
> its interrupt vector with the AEQ.
> 
> [...]

Applied, thanks!

[1/1] RDMA/irdma: Free IRQ when CEQ vector mapping fails
      https://git.kernel.org/rdma/rdma/c/df1d75774b1284

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>