From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06D0A477990; Tue, 16 Jun 2026 16:31:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627512; cv=none; b=KchKjEd2byF7elfP0/mV4sLhGwYuKimipxCxnYh2HSZ6hIQ8ZF8l2Js4ZMP78PiXPAN2zM5tZ6QGuOC6qiHRwwIOPYlWSnkFh4FlKVbGPnCJm1P6ZVe4leBMunXltFJWMKM7CyRx8k/DSSwN7TjbNqAuiJ0XdQ6Fu3zpjcTa9LE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627512; c=relaxed/simple; bh=RVEfSoE4OlBuTaogbbF0d8pgrWJ+KrETF3UKL/fUXIQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aF8yRnjRNxg4mywIrKp40BlTNsNATxhSE2Lys8Mv2lRXMPbMTZxXldt/LGykvVwCpl18fEGmRqu0yMtyiax/JWDQ3nSGSvU4ITHuSsz48+HdM+tBSAyRrBxJKaXGLKRmSCzgkZ1PxOV7L3VoNdKcB0mEIbFfe2x5JlZ8z5YPuQ0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gwguyQ9i; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gwguyQ9i" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14A201F000E9; Tue, 16 Jun 2026 16:31:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781627510; bh=YIKC/JeG03SRJDB2ujYUFmVH/gHvvIdE2e0ku91Nifw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gwguyQ9iobn8yPCdEDxDBEAwPjsbZoS2xyoE4iers+bOOF19GoEDfAjA6e3YRiCjK h7Z7vmUzhX99H+ECRyf1Ln/i+iSKxE0mWDEVRA97GW1hMVIRcR0qUA4EWkP1JnpEnY OZoLF+zjC/GzjdOXXOVu7kkypYK9RtnVI9jbvJw8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, Yuan Tan , Zhengchuan Liang , Xin Liu , Yuqi Xu , Ren Wei , Allison Henderson , Jakub Kicinski Subject: [PATCH 6.12 185/261] net: rds: clear i_sends on setup unwind Date: Tue, 16 Jun 2026 20:30:23 +0530 Message-ID: <20260616145053.640822844@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145044.869532709@linuxfoundation.org> References: <20260616145044.869532709@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuqi Xu commit 20cf0fb715c41111469577e85e35d15f099473e0 upstream. The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state. Fixes: 3b12f73a5c29 ("rds: ib: add error handle") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Reviewed-by: Allison Henderson Link: https://patch.msgid.link/5a0f7624bb9845a7b67d26166a150b59e7f394ce.1779632468.git.xuyq21@lenovo.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/rds/ib_cm.c | 1 + 1 file changed, 1 insertion(+) --- a/net/rds/ib_cm.c +++ b/net/rds/ib_cm.c @@ -656,6 +656,7 @@ static int rds_ib_setup_qp(struct rds_co sends_out: vfree(ic->i_sends); + ic->i_sends = NULL; ack_dma_out: rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,