Re: [PATCH net-next v2 7/9] net/rds: pin the connection across RDMA-CM event handling

[sashiko-bot@kernel.org]

> rds_rdma_cm_event_handler_cmn() picks the connection up from
> cm_id->context, which carries no reference, and holds c_cm_lock - a
> mutex that lives in the connection's path array - across the
> transport callbacks.  Now that a connection is freed by its last
> reference rather than by rds_conn_destroy() itself, a callback that
> drops the last reference other than the handler's implicit one leaves
> the final mutex_unlock() running on freed memory.
> 
> Take a reference for the duration of the handler, and ignore the event
> if the connection is already being freed: its cm_id teardown is what
> stops event delivery, so an event that still arrives belongs to a
> connection whose shutdown has run and whose memory is on its way out.
> 
> rds_ib_cm_handle_connect() has the mirror-image hole: a connection
> whose destroy has already quiesced it sits in RDS_CONN_DOWN with no
> cm_id, which is exactly the state the DOWN -> CONNECTING transition
> claims.  A connect request arriving then would install a new cm_id
> and QP on a connection that is only waiting for its last reference to
> go away, and nothing would tear them down again.  Re-check
> rds_destroy_pending() under c_cm_lock and reject the request instead.
> 
> Assisted-by: Claude-Code:claude-fable-5
> Signed-off-by: Allison Henderson <achender@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912035027.27447-1-achender@kernel.org?part=7