Re: [syzbot] [rdma?] possible deadlock in rds_trans_get_preferred

[syzbot]

>> Date: Sun, 18 Oct 2026 12:14:36 -0700	[thread overview]
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    70dd4ee72eb2 Merge tag 'pinctrl-v7.3-3' of git://git.kerne..
>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1271a69c580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=44ac479246d4559b
>> dashboard link: https://syzkaller.appspot.com/bug?extid=ccdb5058c3df2d94811c
>> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> userspace arch: i386
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15b9618e580000
>
> #syz test

"" does not look like a valid git branch or commit.

>
> --- x/include/rdma/rdma_cm.h
> +++ y/include/rdma/rdma_cm.h
> @@ -167,6 +167,7 @@ struct rdma_cm_id *rdma_create_user_id(r
>    * asynchronous operations associated with the id.
>    */
>  void rdma_destroy_id(struct rdma_cm_id *id);
> +void rdma_destroy_id_wq(struct rdma_cm_id *id);
>  
>  /**
>   * rdma_restrict_node_type - Restrict an RDMA identifier to specific
> --- x/net/rds/ib.c
> +++ y/net/rds/ib.c
> @@ -486,7 +486,7 @@ static int rds_ib_laddr_check_cm(struct
>  		 cm_id->device ? cm_id->device->node_type : -1);
>  
>  out:
> -	rdma_destroy_id(cm_id);
> +	rdma_destroy_id_wq(cm_id);
>  
>  	return ret;
>  }
> --- x/drivers/infiniband/core/cma_priv.h
> +++ y/drivers/infiniband/core/cma_priv.h
> @@ -110,6 +110,7 @@ struct rdma_id_private {
>  	 */
>  	struct rdma_restrack_entry     res;
>  	struct rdma_ucm_ece ece;
> +	struct work_struct destroy_work;
>  };
>  
>  #if IS_ENABLED(CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS)
> --- x/drivers/infiniband/core/cma.c
> +++ y/drivers/infiniband/core/cma.c
> @@ -2126,6 +2126,25 @@ void rdma_destroy_id(struct rdma_cm_id *
>  }
>  EXPORT_SYMBOL(rdma_destroy_id);
>  
> +static void destroy_id_work(struct work_struct *work)
> +{
> +	struct rdma_id_private *id_priv =
> +		container_of(work, struct rdma_id_private, destroy_work);
> +
> +	mutex_lock(&id_priv->handler_mutex);
> +	destroy_id_handler_unlock(id_priv);
> +}
> +
> +void rdma_destroy_id_wq(struct rdma_cm_id *id)
> +{
> +	struct rdma_id_private *id_priv =
> +		container_of(id, struct rdma_id_private, id);
> +
> +	INIT_WORK(&id_priv->destroy_work, destroy_id_work);
> +	queue_work(cma_wq, &id_priv->destroy_work);
> +}
> +EXPORT_SYMBOL(rdma_destroy_id_wq);
> +
>  static int cma_rep_recv(struct rdma_id_private *id_priv)
>  {
>  	int ret;
> --