Re: [PATCH net] rds: fix transport reference leak on rds_add_bound() failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net/rds: explicit SO_RDS_TRANSPORT socket option is unpinned on transient bind failure
--

commit e657dc28c34c2b6450919388879a26bad7d1e8e5
Author: Henry Martin <bsdhenrymartin@gmail.com>

rds: fix transport reference leak on rds_add_bound() failure

This commit fixes a transport reference leak in rds_bind() when rds_add_bound()
fails. It drops the reference via rds_trans_put() and sets rs->rs_transport
to NULL in the failure branch.

> diff --git a/net/rds/bind.c b/net/rds/bind.c
> index f800d920d9690..e4667b3128940 100644
> --- a/net/rds/bind.c
> +++ b/net/rds/bind.c
> @@ -264,8 +264,10 @@ int rds_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
>  
>  	sock_set_flag(sk, SOCK_RCU_FREE);
>  	ret = rds_add_bound(rs, binding_addr, &port, scope_id);
> -	if (ret)
> +	if (ret) {
> +		rds_trans_put(rs->rs_transport);
>  		rs->rs_transport = NULL;
> +	}

[Severity: Medium]
When an explicit transport is configured via setsockopt(SO_RDS_TRANSPORT),
rs->rs_transport is pinned.

If a subsequent bind() fails due to an incompatible address, laddr_check()
fails and returns -ENOPROTOOPT early, which skips the teardown block and
correctly preserves rs->rs_transport.

However, if bind() fails transiently because the port is already in use
(-EADDRINUSE from rds_add_bound()), the modified error path unconditionally
calls rds_trans_put() and clears rs->rs_transport.

Does this destroy the user's explicitly configured socket state on a
transient error, requiring them to silently re-apply the sockopt?

Could we avoid putting and clearing the transport here if it was explicitly
configured prior to calling rds_bind()?

>  
>  out:
>  	release_sock(sk);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010081446.3112217-1-bsdhenrymartin@gmail.com?part=1