On Tue, May 11, 2021 at 11:22:12AM +0300, Leon Romanovsky wrote:Because it was initialized by cm_init_av_for_response() previously, so destroy it here as cm_init_av_by_path() will re-initialize it.
@@ -2139,6 +2197,8 @@ static int cm_req_handler(struct cm_work *work)
sa_path_set_dmac(&work->path[0],
cm_id_priv->av.ah_attr.roce.dmac);
work->path[0].hop_limit = grh->hop_limit;
+
+ cm_destroy_av(&cm_id_priv->av);
ret = cm_init_av_by_path(&work->path[0], gid_attr, &cm_id_priv->av);
if (ret) {
int err;
Why add cm_destroy_av() here? The cm_id_priv was freshly created at
the top of this function and hasn't left the stack frame yet?