On Jun 13, 2023 / 10:43, Shin'ichiro Kawasaki wrote: [...] > My understanding about the call chain to rdma id destroy is as follows. I guess > _destory_id calls iw_destory_cm_id before destroying the rdma id, but not sure > why it does not wait for cm_id deref by cm_work_handler. I found the commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") looks related the issue. Its commit message says that it "removed the block in iw_destroy_cm_id()" to avoid potential deadlock. So it looks cm_id ref no longer guards rdma id destroy. I'm not sure how to fix this issue at IW CM level.