Re: [PATCH net-next v3 07/13] net/rds: unlink transport nodes before a possibly deferred connection free

[sashiko-bot@kernel.org]

> The transport teardown helpers - rds_tcp_destroy_conns(),
> rds_tcp_kill_sock(), rds_ib_destroy_nodev_conns(), rds_loop_exit() and
> rds_loop_kill_conns() - gather the per-connection transport nodes onto
> a list head on their own stack and call rds_conn_destroy() for each.
> The node is unlinked much later, by the transport's conn_free():
> rds_tcp_conn_free() and rds_loop_conn_free() list_del() it, and
> rds_ib_conn_free() does so unconditionally.
> 
> That was fine while rds_conn_destroy() freed the connection before it
> returned.  Once the free is governed by the connection's reference
> count, a holder that outlives the teardown loop - a socket's cached
> rs_conn, an inc parked on a receive queue - defers conn_free() until
> after the helper has returned, and the list_del() then writes the
> neighbours' pointers into a stack frame that no longer exists.
> 
> Unlink each node under the transport lock right before its
> rds_conn_destroy() instead, so that nothing is left on the stack list
> for a later free to touch.  TCP marks the node detached, as
> rds_tcp_kill_sock() already does for the secondary paths of a
> multipath connection; IB and loopback use list_del_init() and have
> their conn_free() skip a node that is already empty.  The tmp_list
> gathering itself is unchanged: it still exists so that
> rds_conn_destroy() is not called with the transport lock held.
> 
> Assisted-by: Claude-Code:claude-fable-5
> Signed-off-by: Allison Henderson <achender@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914033719.138057-1-achender@kernel.org?part=7