Re: [PATCH net-next v12 11/12] net/rds: give cm_id->context a reference on its connection

[sashiko-bot@kernel.org]

> rds_rdma_cm_event_handler_cmn() picks the connection up from
> cm_id->context and holds c_cm_lock - a mutex that lives in the
> connection's path array - across the transport callbacks, but the
> context pointer owns no reference.  What keeps the connection alive
> under the handler is ordering: rds_ib_conn_path_shutdown() destroys the
> id, and rdma_destroy_id() waits for a running handler, before the
> destroy drops the connection's initial reference, so no event is
> handled on a connection that is being freed.  Before this series that
> ordering was broken from inside the handler, since rds_conn_destroy()
> freed synchronously and the one callback that destroyed its
> connection, rds_ib_cm_connect_complete() on a protocol version below
> 3.1, left the handler's mutex_unlock() running on freed memory;
> commit f97d8c7bab78 ("rds: ib: use rds_conn_drop() on protocol version
> mismatch") has since switched that path to rds_conn_drop(), which also
> removed the deadlock that destroy took on c_cm_lock.
> [ ... ]
> rds_ib_add_conn() refusing a device that rds_ib_dev_shutdown() has
> marked.
> 
> Assisted-by: Claude-Code:claude-fable-5
> Signed-off-by: Allison Henderson <achender@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113044355.2932029-1-achender@kernel.org?part=11