UCT/IB/RDMACM: Hold async block over rdma_get_cm_event

The rdmacm CM event handler called rdma_get_cm_event() outside the CM's
async block, then took the block only around uct_rdmacm_cm_process_event().
The ep destructor (uct_rdmacm_cm_ep_t cleanup) and other destroy sites
hold the same block when calling rdma_destroy_id(), so the synchronization
intent was to serialize them with the handler.

The pre-block window let a concurrent rdma_destroy_id() free the cm_id's
userspace tracking while the async thread was mid-lookup inside
rdma_get_cm_event(), producing a NULL deref at the internal
pthread_mutex_lock(&id_priv->mut) call. Observed as a SIGSEGV inside
librdmacm during sockaddr error/wireup-failure gtests under multi-threaded
workers where event delivery and ep teardown interleave more often.

Acquire the async block before rdma_get_cm_event() and release it on the
error/EAGAIN exit path, so the entire fetch + dispatch is serialized with
rdma_destroy_id() callers that hold the same block.

Signed-off-by: NirWolfer <nwolfer@nvidia.com>

Author: NirWolfer

src/uct/ib/rdmacm/rdmacm_cm.c

@@ -813,9 +813,15 @@ static void uct_rdmacm_cm_event_handler(int fd, ucs_event_set_types_t events,
     int                  ret;
 
     for (;;) {
+        /* Hold the async block across rdma_get_cm_event() so a concurrent
+         * rdma_destroy_id() (held under the same block in the ep destructor)
+         * cannot free the cm_id userspace tracking mid-lookup. */
+        UCS_ASYNC_BLOCK(uct_rdmacm_cm_get_async(cm));
+
         /* Fetch an event */
         ret = rdma_get_cm_event(cm->ev_ch, &event);
         if (ret) {
+            UCS_ASYNC_UNBLOCK(uct_rdmacm_cm_get_async(cm));
             /* EAGAIN (in a non-blocking rdma_get_cm_event) means that
              * there are no more events */
             if ((errno != EAGAIN) && (errno != EINTR)) {
@@ -825,7 +831,6 @@ static void uct_rdmacm_cm_event_handler(int fd, ucs_event_set_types_t events,
             return;
         }
 
-        UCS_ASYNC_BLOCK(uct_rdmacm_cm_get_async(cm));
         uct_rdmacm_cm_process_event(cm, event);
         UCS_ASYNC_UNBLOCK(uct_rdmacm_cm_get_async(cm));
     }