On Wed, 26 Mar 2025 14:05:32 -0700, Sharath Srinivasan wrote:
struct rdma_cm_id has member "struct work_struct net_work" that is reused for enqueuing cma_netevent_work_handler()s onto cma_wq.
Below crash[1] can occur if more than one call to cma_netevent_callback() occurs in quick succession, which further enqueues cma_netevent_work_handler()s for the same rdma_cm_id, overwriting any previously queued work-item(s) that was just scheduled to run i.e. there is no guarantee the queued work item may run between two successive calls to cma_netevent_callback() and the 2nd INIT_WORK would overwrite the 1st work item (for the same rdma_cm_id), despite grabbing id_table_lock during enqueue.
[...]
Applied, thanks!
[1/1] RDMA/cma: Fix workqueue crash in cma_netevent_work_handler https://git.kernel.org/rdma/rdma/c/052996ebc39e3e
Best regards,