[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Deepanshu Kartikey]

rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
separate steps. Once the ID is bound it is attached to the device, so
cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
before the second step runs. The exchange then fails and hits the
WARN_ON() added by the commit below.

syzbot triggers this with RDS over rxe, where rds_connect_worker()
calls rdma_resolve_addr() while the rxe device is being deleted:

  WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
  Call Trace:
   rdma_resolve_addr
   rds_ib_conn_path_connect
   rds_connect_worker

This is a valid race and not a kernel bug. If removal wins before the
bind, cma_bind_addr() already fails and the error is returned to the
caller, and err_state in the same function already ignores a failed
state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
error from rdma_resolve_addr(), so nothing is leaked.

Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
that the state may change because of device removal.

Reported-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
Tested-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/cma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 337a49d1acf7..46741c1fd34b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
 		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
 		if (ret)
 			return ret;
-		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
-					   RDMA_CM_ADDR_QUERY)))
+		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
+				   RDMA_CM_ADDR_QUERY))
 			return -EINVAL;
 
 	} else {
-- 
2.43.0

Re: [PATCH] RDMA/cma: Don't warn when device removal races with rdma_resolve_addr()

[Zhu Yanjun]

在 2026/11/1 2:56, Deepanshu Kartikey 写道:
> rdma_resolve_addr() on an unbound ID (RDMA_CM_IDLE) first binds it with
> cma_bind_addr() and then moves it from RDMA_CM_ADDR_BOUND to
> RDMA_CM_ADDR_QUERY with a second cma_comp_exch(). These are two
> separate steps. Once the ID is bound it is attached to the device, so
> cma_send_device_removal_put() can find it and set RDMA_CM_DEVICE_REMOVAL
> before the second step runs. The exchange then fails and hits the
> WARN_ON() added by the commit below.
>
> syzbot triggers this with RDS over rxe, where rds_connect_worker()
> calls rdma_resolve_addr() while the rxe device is being deleted:
>
>    WARNING: drivers/infiniband/core/cma.c:4120 at resolve_prepare_src
>    Call Trace:
>     rdma_resolve_addr
>     rds_ib_conn_path_connect
>     rds_connect_worker
>
> This is a valid race and not a kernel bug. If removal wins before the
> bind, cma_bind_addr() already fails and the error is returned to the
> caller, and err_state in the same function already ignores a failed
> state exchange. The caller gets -EINVAL, and RDS destroys the ID on any
> error from rdma_resolve_addr(), so nothing is leaked.
>
> Drop the WARN_ON() and keep returning -EINVAL, and document in a comment
> that the state may change because of device removal.

Resend this becase some error occurred.

For this specific case, we can consider this behavior expected rather 
than an error and remove the WARN_ON().

However, I'm not sure whether the WARN_ON() is still necessary for other 
test cases.

Yanjun Zhu
>
> Reported-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6699995b421c8ec7d2fe
> Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
> Tested-by: syzbot+6699995b421c8ec7d2fe@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>   drivers/infiniband/core/cma.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 337a49d1acf7..46741c1fd34b 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -4117,8 +4117,8 @@ static int resolve_prepare_src(struct rdma_id_private *id_priv,
>   		ret = cma_bind_addr(&id_priv->id, src_addr, dst_addr);
>   		if (ret)
>   			return ret;
> -		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> -					   RDMA_CM_ADDR_QUERY)))
> +		if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
> +				   RDMA_CM_ADDR_QUERY))
>   			return -EINVAL;
>   
>   	} else {

-- 
Best Regards,
Yanjun.Zhu