From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7A923D8105; Tue, 16 Jun 2026 18:24:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634254; cv=none; b=Mg7NYInnBytAY/A1cOuBsfhMOW1KqlLYxRH9Okm2XBQIVUHw+LTXSQ7BW5x09hlR2vHCLb/b3oq91mCF1xoF34dG+IGj9i5Un5AqD4wsLyILk272J0M9DAbZihtufQWVZ+MAFDENCs2DaQNvmGlTnkLGOZtcM/NHH+FW01MEU60= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634254; c=relaxed/simple; bh=rtHNOHeSChdYI4XjFL60OwVoeyV55IA/SOzyBcQwaJ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mpZkdmV9syeryqPE78t2QUgI4xCZA85WK96KyHS7w33T61fviaTQfl2HJsSYMqyszVFePuAP7Ok9KszIt3f+eTR4uENPQXEh2Vs1TxgWhQxCPNlUsqjMdlibRXmFj7XEGwUzBMyVtyf+grrzyRYLqVFCHJsDoVod9MxByZDvNsc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oebZYj2R; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oebZYj2R" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7272E1F000E9; Tue, 16 Jun 2026 18:24:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781634253; bh=EaxynOV+pWp/obnbCi6+K7p5Ihr7DbZHVm9hLPlfyiY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oebZYj2RUAkhNHT60zfANmiqN8N38CsRXWBqw8GUc2MoniqBQkD4bP5qI/Jz9NmhQ 3Ky5IVluM173SHYSKSCdc6xrncfrWs6CZQRxSbaiEfUjCToUmQkS6Km3MLG6cqbBDJ y3NTTFfaoRgd4IsY+AdsEsviSIAiliX3kK9AWCBo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, Yuan Tan , Zhengchuan Liang , Xin Liu , Yuqi Xu , Ren Wei , Allison Henderson , Jakub Kicinski Subject: [PATCH 5.15 231/411] net: rds: clear i_sends on setup unwind Date: Tue, 16 Jun 2026 20:27:49 +0530 Message-ID: <20260616145113.106948285@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145100.376842714@linuxfoundation.org> References: <20260616145100.376842714@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yuqi Xu commit 20cf0fb715c41111469577e85e35d15f099473e0 upstream. The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state. Fixes: 3b12f73a5c29 ("rds: ib: add error handle") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Reviewed-by: Allison Henderson Link: https://patch.msgid.link/5a0f7624bb9845a7b67d26166a150b59e7f394ce.1779632468.git.xuyq21@lenovo.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/rds/ib_cm.c | 1 + 1 file changed, 1 insertion(+) --- a/net/rds/ib_cm.c +++ b/net/rds/ib_cm.c @@ -656,6 +656,7 @@ static int rds_ib_setup_qp(struct rds_co sends_out: vfree(ic->i_sends); + ic->i_sends = NULL; ack_dma_out: rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,