Re: [PATCH net-next v7 08/12] net/rds: hold a connection reference from struct rds_incoming

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found more severe
issue(s) in other patches of this series. This mail is only an FYI, in case
you want to address the nit picks below when you respin.

Low priority / nit picks for your consideration:

- [Low] The commit fixes a use-after-free that users can hit and that was
  reported with a KASAN trace and a panic trace (Reported-by/Closes tags…

--

net/rds: hold a connection reference from struct rds_incoming

This commit makes every holder of rds_incoming->i_conn take a reference
on the connection. It covers rds_inc_init(), rds_inc_path_init(),
rds_recv_incoming(), rds_send_queue_rm(), rds_send_probe() and the
congestion map path of rds_send_xmit(). The references are dropped from
rds_inc_put() and from a new rds_message_free() helper, which fixes a
use-after-free of the connection seen from rds6_inc_info_copy() and from
rds_ib_inc_free() after the connection has been destroyed.

Closes: https://lore.kernel.org/netdev/20260720184955.3008978-1-nicoyip.dev@gmail.com/

> This is not a stable candidate: reaching the use-after-free requires
> freeing a connection out from under a live socket, which needs
> CAP_SYS_MODULE, and the fix
> depends on the connection reference counting introduced earlier in this
> series.

[ ... ]

> Reported-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260720184955.3008978-1-nicoyip.dev@gmail.com/

[Severity: Low]
This isn't a bug, but should the commit carry a Fixes: tag?

It fixes a use-after-free that has been reported, with a KASAN trace in
rds6_inc_info_copy() and a panic in rds_ib_recv_cache_put(), and it has
Reported-by and Closes trailers. The unreferenced i_conn pointer appears
to date back to the original RDS code.

Leaving the tag out looks deliberate. The quoted paragraph says the patch
depends on the connection reference counting added earlier in this series,
and a Fixes: tag could lead stable tooling to pick it up without those
prerequisites.

Would it help to add a Fixes: tag pointing at the commit that introduced
i_conn, maybe together with a note or a Cc: stable line that names the
prerequisite patches? That way the origin of the bug is recorded without
inviting a partial backport.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260927061448.167862-1-achender%40kernel.org