Re: [PATCH] RDMA/cm: fix timewait leak and AV cleanup on ib_send_cm_req() errors

[Jason Gunthorpe <jgg@nvidia.com>]

On Thu, May 07, 2026 at 05:43:17PM +0800, Chenguang Zhao wrote:
> cm_create_timewait_info() success was followed by error returns that
> never freed cm_id_priv->timewait_info, leaking it and tripping the
> WARN_ON(timewait_info) on a later ib_send_cm_req().

Yes, Leon is right, the ucma doesn't allow a ib_send_cm_req to be
called twice and it would be an error for any in-kernel caller to send
the same thing.

> -out_free:
> +err_free_msg:
>  	cm_free_priv_msg(msg);
> -out_unlock:
> +err_destroy_id_av:
> +	if (param->alternate_path)
> +		cm_destroy_av(&cm_id_priv->alt_av);
> +	cm_destroy_av(&cm_id_priv->av);

And this doesn't properly understand the lifetime model of the av, it
should not be freed here.

I did find a real leak on error path while looking at this though :\

Jason