Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Zhu Yanjun]

在 2026/11/1 2:56, Deepanshu Kartikey 写道:
> rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
> cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
> RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
> separate steps. Once the ID is bound it is attached to the device, so
> cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
> before the second step runs. The exchange then fails and hits the
> WARN_ON() added by the commit below.
>
> syzbot triggers this with RDS over rxe, where rds_connect_worker()
> calls rdma_resolve_addr() while the rxe device is being deleted:
>
>    WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
>    Call Trace:
>     rdma_resolve_addr
>     rds_ib_conn_path_connect
>     rds_connect_worker
>
> This is a valid race and not a kernel bug. If removal wins before the
> bind, cma_bind_addr() already fails and the error is returned to the
> caller, and err_state in the same function already ignores a failed
> state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
> error from rdma_resolve_addr(), so nothing is leaked.
>
> Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
> that the state may change because of device removal.

Resend this becase some error occurred.

For this specific case, we can consider this behavior expected rather 
than an error and remove the WARN_ON().

However, I'm not sure whether the WARN_ON() is still necessary for other 
test cases.

Yanjun Zhu
> Reported-by: syzbot+6699995b421c8ec7d2fe@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
> Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
> Tested-by: syzbot+6699995b421c8ec7d2fe@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> ---
>   drivers/infiniband/core/cma.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf7..46741c1fd34b 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>   		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>   		if (ret)
>   			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>   			return -EINVAL;
>   
>   	} else {

--
Best Regards,
Yanjun.Zhu