[PATCH net 0/2] net/rds: fix init failures leaving built-in transports on a dead core

[Allison Henderson <achender@kernel.org>]

The kernel test robot hit a slab-use-after-free on rds_wq at boot with
CONFIG_SYSCTL=n and RDS, RDS_RDMA and RDS_TCP built in [1].  Two
separate bugs are involved.

With CONFIG_SYSCTL=n, register_net_sysctl() is a stub that returns
NULL, and RDS treats that as -ENOMEM, so rds_init() fails even though
every tunable has a usable default.  Patch 1 only treats NULL as a
failure when sysctl support is built in.

Second, when RDS is built in, a failed rds_init() does not stop the
rds_rdma and rds_tcp initcalls.  They run against a core that has
already been torn down and queue onto or flush the freed rds_wq.  The
error path of rds_ib_init() did this in the robot's report.  The
rds_tcp listen socket can also do it when an incoming connection
arrives.  Patch 2 makes both transports bail out with -ENODEV unless
rds_init() succeeded.  Modular builds can't hit this, because the
transports need symbols from rds.ko.

Thanks to Oleg Nesterov and Joel Granados for the analysis in [2].

Testing: x86_64 under virtme-ng, built in RDS/RDS_RDMA/RDS_TCP,
CONFIG_SYSCTL=n, KASAN, booted with initcall_debug:
  - net/main: rds_init() returns -ENOMEM, then rds_rdma_init() hits
    KASAN slab-use-after-free in __flush_workqueue() from rds_ib_init(),
    reproducing [1].
  - patch 2 only: rds_init() still returns -ENOMEM; rds_rdma_init() and
    rds_tcp_init() return -ENODEV and the boot completes cleanly.
  - both patches: rds_init(), rds_rdma_init() and rds_tcp_init() all
    return 0, no KASAN reports.

[1] https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
[2] https://lore.kernel.org/all/atdoGiW_sHlWgOwt@redhat.com/


Allison Henderson (2):
  net/rds: do not fail init when CONFIG_SYSCTL=n
  net/rds: do not initialize transports after rds_init() failed

 net/rds/af_rds.c         | 14 ++++++++++++++
 net/rds/ib_sysctl.c      |  2 +-
 net/rds/rdma_transport.c |  3 +++
 net/rds/rds.h            |  1 +
 net/rds/sysctl.c         |  2 +-
 net/rds/tcp.c            |  5 ++++-
 6 files changed, 24 insertions(+), 3 deletions(-)

-- 
2.50.1