Re: [PATCH rdma-next v2 01/14] RDMA/cma: Delete from restrack DB after successful destroy

[Jason Gunthorpe <jgg@nvidia.com>]

On Mon, Sep 07, 2020 at 03:21:43PM +0300, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@mellanox.com>
> 
> Update the code to have similar destroy pattern like other IB objects.
> 
> This change create asymmetry to the rdma_id_private create flow to make
> sure that memory is managed by restrack.
> 
> Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
>  drivers/infiniband/core/cma.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index f9ff8b7f05e7..24e09416de4f 100644
> +++ b/drivers/infiniband/core/cma.c
> @@ -1821,7 +1821,6 @@ static void _destroy_id(struct rdma_id_private *id_priv,
>  {
>  	cma_cancel_operation(id_priv, state);
>  
> -	rdma_restrack_del(&id_priv->res);
>  	if (id_priv->cma_dev) {
>  		if (rdma_cap_ib_cm(id_priv->id.device, 1)) {
>  			if (id_priv->cm_id.ib)
> @@ -1847,6 +1846,7 @@ static void _destroy_id(struct rdma_id_private *id_priv,
>  		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
>  
>  	put_net(id_priv->id.route.addr.dev_addr.net);
> +	rdma_restrack_del(&id_priv->res);
>  	kfree(id_priv);
>  }

This is wrong, rdma_restrack_del() has to be called before
ib_destroy_cm_id() because restrack reaches into the cm_id and touches
that memory:

	case RDMA_RESTRACK_CM_ID:
		return container_of(res, struct rdma_id_private,
				    res)->id.device;

Which will now be freed after this change.

Jason