Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Leon Romanovsky]

On Sun, Nov 01, 2026 at 04:26:15PM +0530, Deepanshu Kartikey wrote:
> rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
> cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
> RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
> separate steps. Once the ID is bound it is attached to the device, so
> cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
> before the second step runs. The exchange then fails and hits the
> WARN_ON() added by the commit below.
> 
> syzbot triggers this with RDS over rxe, where rds_connect_worker()
> calls rdma_resolve_addr() while the rxe device is being deleted:
> 
>   WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
>   Call Trace:
>    rdma_resolve_addr
>    rds_ib_conn_path_connect
>    rds_connect_worker

Please never trim kernel dump stack and add full splat.

> 
> This is a valid race and not a kernel bug. If removal wins before the
> bind, cma_bind_addr() already fails and the error is returned to the
> caller, and err_state in the same function already ignores a failed
> state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
> error from rdma_resolve_addr(), so nothing is leaked.

Why is this a valid race? The expectation is that when a device is removed,
the ib_client is notified first and then deleted. RDS should stop all
communication with the underlying device so it can be unregistered cleanly.

> 
> Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
> that the state may change because of device removal.

I think that it is not correct and the issue is in RDS.

Thanks

> 
> Reported-by: syzbot+6699995b421c8ec7d2fe@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
> Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
> Tested-by: syzbot+6699995b421c8ec7d2fe@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> ---
>  drivers/infiniband/core/cma.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf7..46741c1fd34b 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>  		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>  		if (ret)
>  			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>  			return -EINVAL;
>  
>  	} else {
> -- 
> 2.43.0
>