Re:Re: [PATCH 1/3] rdma: Fix kernel crash in dtr_create_rx_desc()

[ZhengbingHuang]

Hi Philipp,
Thanks for reply.


From: Philipp Reisner <philipp.reisner at linbit.com>
Date: 2025-07-31 20:35:17
To:  "zhengbing.huang" <zhengbing.huang at easystack.cn>
Cc:  drbd-dev at lists.linbit.com
Subject: Re: [PATCH 1/3] rdma: Fix kernel crash in dtr_create_rx_desc()>Hi Zhengbing,
>
>Thanks for the analysis and the patch. I took the freedom and slightly
>modified it before applying it. Instead of changing the behaviour of
>the dtr_path_get_cm() function I introduce a new one:
>dtr_path_get_cm_connected().
>
>Please see
>https://github.com/LINBIT/drbd/commit/ae1b0bdfa2e4ea59d15199b55a6f0c571844f576
>
>Also ...
>
>[...]
>> -       for (i = DATA_STREAM; i <= CONTROL_STREAM ; i++)
>> -               dtr_create_rx_desc(&path->flow[i], GFP_NOIO);
>> -
>
Sorry for the lack of explanation for this part of the code. 


These two lines of code are in the path prepare phase, 
so the cm state at this time is definitely not connected. 
After the dtr_create_rx_desc() function calls the dtr_path_get_cm_connected() function, 
it is definitely impossible to create rx_desc, which is the reason for delete them.

And in the test after delete this code, the rdma connection was normal.
>I dropped this part. It came without explanation in the commit
>message. I believe that some RDMA transports require at least one
>rx-descriptor to enable them to establish a connection.
>
>
>Best regards,
> Philipp
>
Best regards,
  zhengbing







-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linbit.com/pipermail/drbd-dev/attachments/20250801/46cfd20e/attachment.htm>