Re: [PATCH] RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

[Jinpu Wang]

Hi Leon, hi Quanye,

I had a look at the report. The syzbot bug seems to be triggered with
smbdirect (ib_dev[syz2] removed), so I'm not sure how this change in
RTRS client would fix that issue.

Thanks,
Jinpu

On Wed, Sep 2, 2026 at 6:25 PM Leon Romanovsky <leon@xxxxxxxxxx> wrote:
>
> On Sun, Aug 30, 2026 at 03:09:55PM +0800, Quanye Yang via B4 Relay wrote:
> > From: Quanye Yang <quanyeyang@xxxxxxxxx>
> >
> > The client borrows shared CQ credits in the ADDR_RESOLVED handler via
> > ib_cq_pool_get(), before the peer is connected. create_cm() can return
> > -ERESTARTSYS from wait_event_interruptible_timeout() without destroying
> > the CM ID. The init_conns() and stop-and-destroy paths then call
> > destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards
> > rdma_destroy_id().
> >
> > CMA serializes the handler against rdma_destroy_id() with handler_mutex,
> > but that does not order the GET against destroy_con_cq_qp(). If
> > ADDR_RESOLVED has already passed the DESTROYING check, it can take
> > con_mutex, GET credits, and then lose the con to kfree. Device
> > unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().
> >
> > Set a per-connection flag under con_mutex before CQ/QP teardown so a
> > racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
> >
> > Reported-by: syzbot+d396918a29afb8543e1c@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=d396918a29afb8543e1c
> > Fixes: 3b89e92c2a95 ("RDMA/rtrs: Use new shared CQ mechanism")
> > Signed-off-by: Quanye Yang <quanyeyang@xxxxxxxxx>
> > ---
> > Fix a syzbot WARNING in ib_cq_pool_cleanup(): an ADDR_RESOLVED handler
> > can ib_cq_pool_get() after connection teardown has already skipped the
> > matching PUT.
> >
> > Reproduced on rxe with rnbd-client only (no rtrs server): write
> > map_device with path=ip:127.0.0.1, interrupt create_cm() with a signal,
> > then rdma link delete. Device unregister no longer reports leftover
> > cqe_used after this change.
> > ---
> >  drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 ++++++++
> >  drivers/infiniband/ulp/rtrs/rtrs-clt.h | 2 ++
> >  2 files changed, 10 insertions(+)
>
> Haris, Jack?
>
> Thanks