On Wed, May 26, 2021 at 10:46:47AM +0800, Mark Zhang wrote: > On 5/26/2021 4:00 AM, Jason Gunthorpe wrote: > > On Tue, May 11, 2021 at 11:22:12AM +0300, Leon Romanovsky wrote: > > > @@ -2139,6 +2197,8 @@ static int cm_req_handler(struct cm_work *work) > > > sa_path_set_dmac(&work->path[0], > > > cm_id_priv->av.ah_attr.roce.dmac); > > > work->path[0].hop_limit = grh->hop_limit; > > > + > > > + cm_destroy_av(&cm_id_priv->av); > > > ret = cm_init_av_by_path(&work->path[0], gid_attr, &cm_id_priv->av); > > > if (ret) { > > > int err; > > > > Why add cm_destroy_av() here? The cm_id_priv was freshly created at > > the top of this function and hasn't left the stack frame yet? > > > Because it was initialized by cm_init_av_for_response() previously, so > destroy it here as cm_init_av_by_path() will re-initialize it. Oh.. ouch, I once tried to re-order this so it wasn't doing such crazy stuff, but it was too hard. Please just add a comment the destroy is for the cm_init_av_for_response Jason