RDMA/cm: Spurious WARNING triggered in cm_destroy_id()

If the cm_id state is IB_CM_REP_SENT when cm_destroy_id() is called, it
calls cm_send_rej_locked().

In cm_send_rej_locked(), it calls cm_enter_timewait() and the state is
changed to IB_CM_TIMEWAIT.

Now back to cm_destroy_id(), it breaks from the switch statement, and the
next call is WARN_ON(cm_id->state != IB_CM_IDLE).

This triggers a spurious warning. Instead, the code should goto retest
after returning from cm_send_rej_locked() to move the state to IDLE.

Fixes: 67b3c8d ("RDMA/cm: Make sure the cm_id is in the IB_CM_IDLE state in destroy")
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Ka-Cheong Poon <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>

Orabug: 31483278

(cherry picked from commit fba97dc)
cherry-pick-repo=linux/kernel/git/torvalds/linux.git
unmodified-from-upstream: fba97dc

Signed-off-by: Ka-Cheong Poon <[email protected]>
Tested-by: June Wang <[email protected]>
Reviewed-by: Sharath Srinivasan <[email protected]>

Author: kcp-git

drivers/infiniband/core/cm.c

@@ -1073,7 +1073,9 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
 	case IB_CM_REP_SENT:
 	case IB_CM_MRA_REP_RCVD:
 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
-		/* Fall through */
+		cm_send_rej_locked(cm_id_priv, IB_CM_REJ_CONSUMER_DEFINED, NULL,
+				   0, NULL, 0);
+		goto retest;
 	case IB_CM_MRA_REQ_SENT:
 	case IB_CM_REP_RCVD:
 	case IB_CM_MRA_REP_SENT: