RDMA/bnxt_re: Free CQ toggle page after firmware teardown

Free the toggle page only after firmware teardown completes so that
an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write
the toggle value to an already-freed page. Move free_page() after
bnxt_qplib_destroy_cq.

Fixes: e275919d9669 ("RDMA/bnxt_re: Share a page to expose per CQ info with userspace")
Link: https://patch.msgid.link/r/20260615224751.232802-4-selvin.xavier@broadcom.com
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index e48ae2e62be88374e34e2014a83d422449c1b15a..35905ae7d1680d27f8cff33ea77a220f0a7af405 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -3472,11 +3472,11 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
        if (ret)
                return ret;
 
-       if (cctx->modes.toggle_bits & BNXT_QPLIB_CQ_TOGGLE_BIT) {
-               free_page((unsigned long)cq->uctx_cq_page);
+       if (cctx->modes.toggle_bits & BNXT_QPLIB_CQ_TOGGLE_BIT)
                hash_del(&cq->hash_entry);
-       }
        bnxt_qplib_destroy_cq(&rdev->qplib_res, &cq->qplib_cq);
+       if (cctx->modes.toggle_bits & BNXT_QPLIB_CQ_TOGGLE_BIT)
+               free_page((unsigned long)cq->uctx_cq_page);
 
        bnxt_re_put_nq(rdev, nq);