[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Deepanshu Kartikey]

rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
separate steps. Once the ID is bound it is attached to the device, so
cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
before the second step runs. The exchange then fails and hits the
WARN_ON() added by the commit below.

syzbot triggers this with RDS over rxe, where rds_connect_worker()
calls rdma_resolve_addr() while the rxe device is being deleted:

  WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
  Call Trace:
   rdma_resolve_addr
   rds_ib_conn_path_connect
   rds_connect_worker

This is a valid race and not a kernel bug. If removal wins before the
bind, cma_bind_addr() already fails and the error is returned to the
caller, and err_state in the same function already ignores a failed
state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
error from rdma_resolve_addr(), so nothing is leaked.

Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
that the state may change because of device removal.

Reported-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
Tested-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/cma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 337a49d1acf7..46741c1fd34b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
 		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
 		if (ret)
 			return ret;
-		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
-					   RDMA_CM_ADDR_QUERY)))
+		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
+				   RDMA_CM_ADDR_QUERY))
 			return -EINVAL;
 
 	} else {
-- 
2.43.0

Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] RDMA/cma: missing comment in resolve_prepare_src() promised by commit message
--

commit b9b0fc41a9bfe112cf7965b88795f6ea037bc2e0
Author: Deepanshu Kartikey <kartikey406@gmail.com>

RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

This commit removes the WARN_ON() in resolve_prepare_src() when
transitioning an RDMA CM ID from RDMA_CM_ADDR_BOUND to RDMA_CM_ADDR_QUERY
after cma_bind_addr(), as a concurrent device removal can legitimately
change the state to RDMA_CM_DEVICE_REMOVAL.

>     Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
>     that the state may change because of device removal.

[ ... ]

> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf72..a30f367753241 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>  		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>  		if (ret)
>  			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>  			return -EINVAL;

[Severity: Low]
This isn't a bug, but the commit message mentions documenting in a comment
that the state may change because of device removal, whereas the diff in
resolve_prepare_src() in drivers/infiniband/core/cma.c only removes the
WARN_ON() around cma_comp_exch(). Was that comment accidentally left out of
the patch, or should the commit message be updated?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261101105615.20253-1-kartikey406@gmail.com?part=1