[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Deepanshu Kartikey]

rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
separate steps. Once the ID is bound it is attached to the device, so
cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
before the second step runs. The exchange then fails and hits the
WARN_ON() added by the commit below.

syzbot triggers this with RDS over rxe, where rds_connect_worker()
calls rdma_resolve_addr() while the rxe device is being deleted:

  WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
  Call Trace:
   rdma_resolve_addr
   rds_ib_conn_path_connect
   rds_connect_worker

This is a valid race and not a kernel bug. If removal wins before the
bind, cma_bind_addr() already fails and the error is returned to the
caller, and err_state in the same function already ignores a failed
state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
error from rdma_resolve_addr(), so nothing is leaked.

Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
that the state may change because of device removal.

Reported-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
Tested-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/cma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 337a49d1acf7..46741c1fd34b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
 		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
 		if (ret)
 			return ret;
-		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
-					   RDMA_CM_ADDR_QUERY)))
+		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
+				   RDMA_CM_ADDR_QUERY))
 			return -EINVAL;
 
 	} else {
-- 
2.43.0

Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] RDMA/cma: missing comment in resolve_prepare_src() promised by commit message
--

commit b9b0fc41a9bfe112cf7965b88795f6ea037bc2e0
Author: Deepanshu Kartikey <kartikey406@gmail.com>

RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

This commit removes the WARN_ON() in resolve_prepare_src() when
transitioning an RDMA CM ID from RDMA_CM_ADDR_BOUND to RDMA_CM_ADDR_QUERY
after cma_bind_addr(), as a concurrent device removal can legitimately
change the state to RDMA_CM_DEVICE_REMOVAL.

>     Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
>     that the state may change because of device removal.

[ ... ]

> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf72..a30f367753241 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>  		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>  		if (ret)
>  			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>  			return -EINVAL;

[Severity: Low]
This isn't a bug, but the commit message mentions documenting in a comment
that the state may change because of device removal, whereas the diff in
resolve_prepare_src() in drivers/infiniband/core/cma.c only removes the
WARN_ON() around cma_comp_exch(). Was that comment accidentally left out of
the patch, or should the commit message be updated?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261101105615.20253-1-kartikey406@gmail.com?part=1

Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Zhu Yanjun]

在 2026/11/1 2:56, Deepanshu Kartikey 写道:
> rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
> cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
> RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
> separate steps. Once the ID is bound it is attached to the device, so
> cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
> before the second step runs. The exchange then fails and hits the
> WARN_ON() added by the commit below.
>
> syzbot triggers this with RDS over rxe, where rds_connect_worker()
> calls rdma_resolve_addr() while the rxe device is being deleted:
>
>    WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
>    Call Trace:
>     rdma_resolve_addr
>     rds_ib_conn_path_connect
>     rds_connect_worker
>
> This is a valid race and not a kernel bug. If removal wins before the
> bind, cma_bind_addr() already fails and the error is returned to the
> caller, and err_state in the same function already ignores a failed
> state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
> error from rdma_resolve_addr(), so nothing is leaked.
>
> Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
> that the state may change because of device removal.

Resend this becase some error occurred.

For this specific case, we can consider this behavior expected rather 
than an error and remove the WARN_ON().

However, I'm not sure whether the WARN_ON() is still necessary for other 
test cases.

Yanjun Zhu
>
> Reported-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
> Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
> Tested-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>   drivers/infiniband/core/cma.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf7..46741c1fd34b 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>   		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>   		if (ret)
>   			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>   			return -EINVAL;
>   
>   	} else {

-- 
Best Regards,
Yanjun.Zhu

Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Deepanshu Kartikey]

On Mon, Nov 2, 2026 at 1:56 AM Zhu Yanjun <yanjun.zhu@linux.dev> wrote:
>
>
> 在 2026/11/1 2:56, Deepanshu Kartikey 写道:
> > rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
> > cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
> > RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
> > separate steps. Once the ID is bound it is attached to the device, so
> > cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
> > before the second step runs. The exchange then fails and hits the
> > WARN_ON() added by the commit below.
> >
> > syzbot triggers this with RDS over rxe, where rds_connect_worker()
> > calls rdma_resolve_addr() while the rxe device is being deleted:
> >
> >    WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
> >    Call Trace:
> >     rdma_resolve_addr
> >     rds_ib_conn_path_connect
> >     rds_connect_worker
> >
> > This is a valid race and not a kernel bug. If removal wins before the
> > bind, cma_bind_addr() already fails and the error is returned to the
> > caller, and err_state in the same function already ignores a failed
> > state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
> > error from rdma_resolve_addr(), so nothing is leaked.
> >
> > Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
> > that the state may change because of device removal.
>
> Resend this becase some error occurred.
>
> For this specific case, we can consider this behavior expected rather
> than an error and remove the WARN_ON().
>
> However, I'm not sure whether the WARN_ON() is still necessary for other
> test cases.
>

Hi Yanjun,

Thanks for the review. After cma_bind_addr() succeeds the state is
ADDR_BOUND, and the only legitimate change before the second exchange is
device removal (cma_send_device_removal_put() sets DEVICE_REMOVAL under
id_priv->lock without comparing the old state). The other ways to fail
are ULP misuse (a concurrent destroy or a concurrent call on the same
ID), and those still get -EINVAL returned to the caller, as before.
Only the stack trace is dropped.

I can send a v2 that adds a comment explaining the race, and keeps the
WARN_ON() for states other than DEVICE_REMOVAL if you or the
maintainers prefer. Please let me know.

Thanks,
Deepanshu