Re: [PATCH] IB/cm: hold a cm_id reference across the send error callback

[sashiko-bot@kernel.org]

> cm_process_send_error() lets cm_free_priv_msg() release the reference the
> message held on the cm_id and then keeps using cm_id_priv, dropping
> cm_id_priv->lock and calling the consumer's cm_handler() callback. If that
> was the last reference, a concurrent ib_destroy_cm_id() takes the count to
> zero and returns while the callback is still running, so the consumer frees
> its context underneath it. For an RDMA CM consumer that context is the
> rdma_id_private which _destroy_id() kfree()s once ib_destroy_cm_id() has
> returned, and the callback reads it through cm_id->context before any state
> check.
> 
> Reaching this needs a send that expects a response, so a REQ, REP, DREQ or
> SIDR_REQ, to complete with a real error rather than a flush, and the
> consumer to destroy the id while that error is being processed.
> 
> The report below comes from an out-of-tree KUnit test. The race is a few
> [ ... ]
> path.
> 
> Fixes: c1cf6d9f743aa ("IB/cm: Call the correct message free functions in cm_send_handler()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261024155507.3418345-1-yhlee@isslab.korea.ac.kr?part=1