Re: [PATCH rdma-rc] RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work

[Sharath Srinivasan <sharath.srinivasan@oracle.com>]

On 2025-05-21 4:36 a.m., Leon Romanovsky wrote:
> From: Jack Morgenstein <jackm@nvidia.com>
> 
> The cited commit fixed a crash when cma_netevent_callback was called for
> a cma_id while work on that id from a previous call had not yet started.
> The work item was re-initialized in the second call, which corrupted the
> work item currently in the work queue.
> 
> However, it left a problem when queue_work fails (because the item is
> still pending in the work queue from a previous call). In this case,
> cma_id_put (which is called in the work handler) is therefore not
> called. This results in a userspace process hang (zombie process).
> 
> Fix this by calling cma_id_put() if queue_work fails.
> 
> Fixes: 45f5dcdd0497 ("RDMA/cma: Fix workqueue crash in cma_netevent_work_handler")

IMO the above Fixes: tag should point to the commit that introduced the line:
"queue_work(cma_wq, &current_id->id.net_work);"

i.e. Fixes: 925d046e7e52 ("RDMA/core: Add a netevent notifier to cma")

and not another bug fix (45f5dcdd0497) which did not introduce the problem being described in this patch (a missing cma_id_put() when queue_work() fails).

Otherwise the fix looks good to me:
Reviewed-by: Sharath Srinivasan <sharath.srinivasan@oracle.com>

Thanks,
Sharath

> Signed-off-by: Jack Morgenstein <jackm@nvidia.com>
> Signed-off-by: Feng Liu <feliu@nvidia.com>
> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>  drivers/infiniband/core/cma.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index ab31eefa916b3..274cfbd5aaba7 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -5245,7 +5245,8 @@ static int cma_netevent_callback(struct notifier_block *self,
>  			   neigh->ha, ETH_ALEN))
>  			continue;
>  		cma_id_get(current_id);
> -		queue_work(cma_wq, &current_id->id.net_work);
> +		if (!queue_work(cma_wq, &current_id->id.net_work))
> +			cma_id_put(current_id);
>  	}
>  out:
>  	spin_unlock_irqrestore(&id_table_lock, flags);