Re: [PATCH] RDMA/ucma: Serialize join and leave on copy_to_user failure

[Leon Romanovsky]

On Mon, 31 Aug 2026 20:30:58 +0800, Quanye Yang wrote:
> rdma_join_multicast() queues RoCE work that later reads the ucma_multicast
> through event->param.ud.private_data, then list_add()s the CMA multicast
> at the head of id_priv->mc_list. rdma_leave_multicast() matches only by
> sockaddr and destroys the first hit.
> 
> ucma_process_join() used to drop ctx->mutex after a successful join and
> retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls
> with the same address can therefore insert a second CMA entry before the
> first thread's leave. leave then cancels the newer work and the older
> worker still dereferences the ucma_multicast that the first thread frees.
> 
> [...]

Applied, thanks!

[1/1] RDMA/ucma: Serialize join and leave on copy_to_user failure
      https://git.kernel.org/rdma/rdma/c/662ade4de9ff5e

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>