Re: [PATCH] RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

[Leon Romanovsky]

On Sun, Aug 30, 2026 at 03:09:55PM +0800, Quanye Yang via B4 Relay wrote:
> From: Quanye Yang <quanyeyang@xxxxxxxxx>
> 
> The client borrows shared CQ credits in the ADDR_RESOLVED handler via
> ib_cq_pool_get(), before the peer is connected. create_cm() can return
> -ERESTARTSYS from wait_event_interruptible_timeout() without destroying
> the CM ID. The init_conns() and stop-and-destroy paths then call
> destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards
> rdma_destroy_id().
> 
> CMA serializes the handler against rdma_destroy_id() with handler_mutex,
> but that does not order the GET against destroy_con_cq_qp(). If
> ADDR_RESOLVED has already passed the DESTROYING check, it can take
> con_mutex, GET credits, and then lose the con to kfree. Device
> unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().
> 
> Set a per-connection flag under con_mutex before CQ/QP teardown so a
> racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
> 
> Reported-by: syzbot+d396918a29afb8543e1c@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=d396918a29afb8543e1c
> Fixes: 3b89e92c2a95 ("RDMA/rtrs: Use new shared CQ mechanism")
> Signed-off-by: Quanye Yang <quanyeyang@xxxxxxxxx>
> ---
> Fix a syzbot WARNING in ib_cq_pool_cleanup(): an ADDR_RESOLVED handler
> can ib_cq_pool_get() after connection teardown has already skipped the
> matching PUT.
> 
> Reproduced on rxe with rnbd-client only (no rtrs server): write
> map_device with path=ip:127.0.0.1, interrupt create_cm() with a signal,
> then rdma link delete. Device unregister no longer reports leftover
> cqe_used after this change.
> ---
>  drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 ++++++++
>  drivers/infiniband/ulp/rtrs/rtrs-clt.h | 2 ++
>  2 files changed, 10 insertions(+)

Haris, Jack?

Thanks